Shorewall users - Jun 2005 - Nat as internal firewall

I have a strange situation.  I have a shorewall firewall with 4
interfaces.  This firewall is an internal lab firewall with all 4
networks being private.  The configuration is as follows:

 

Eth0:  192.168.10.187 - This is the main lab network

Eth1:  10.10.10.1

Eth2:   172.26.4.1

Eth3:    192.168.1.1

 

I would like to be able to put a host behind this firewall with
interfaces on all 3 private networks.  In order to avoid routing issues
on the host I would like the firewall to NAT traffic destined for this
host as whatever internal interface it is using.  In other words I would
like to configure routing outside of the firewall to send traffic for
the 3 private networks to 192.168.10.187 and then have the firewall NAT
the traffic as the internal interface it uses so that the final host
will see the packet as originating from a locally connected network.  Is
this possible?

 

Thanks. 
  
--------------------------------------------------------
 
This message (and any associated files) is intended only for the use of the
individual or entity to which it is addressed, is confidential and proprietary
information of AppIQ, Inc., and may contain information that is subject to
copyright or constitutes a trade secret. If you have received this message in
error, please notify the sender immediately by telephone or email and delete
this message from your computer without making a copy. Messages sent to and from
us may be monitored.

On Tuesday 28 June 2005 18:12, Paul Hogan wrote:
> I have a strange situation.  I have a shorewall firewall with 4
> interfaces.  This firewall is an internal lab firewall with all 4
> networks being private.  The configuration is as follows:
>
>
>
> Eth0:  192.168.10.187 - This is the main lab network
>
> Eth1:  10.10.10.1
>
> Eth2:   172.26.4.1
>
> Eth3:    192.168.1.1
>
>
>
> I would like to be able to put a host behind this firewall with
> interfaces on all 3 private networks.  In order to avoid routing issues
> on the host I would like the firewall to NAT traffic destined for this
> host as whatever internal interface it is using.  In other words I would
> like to configure routing outside of the firewall to send traffic for
> the 3 private networks to 192.168.10.187 and then have the firewall NAT
> the traffic as the internal interface it uses so that the final host
> will see the packet as originating from a locally connected network.  Is
> this possible?
>
Yes it is. With SNAT aka Masquerading.

By using something like this in your /etc/shorewall/masq file:

eth1 eth0
eth2 eth0
eth3 eth0

But probably you will want to qualify which traffic to masq more detailed.

Just see the examples in the /etc/shorewall/masq file and 
http://shorewall.net/Documentation.htm#Masq

HTH,
Alex