similar to: SNAT multiple IP to single internal IP and limiting access based on external IP

On Friday 24 June 2005 20:57, Derek Vincent wrote: >>Hello all, >> >>I have shorewall setup with 3 SNAT entries for external IP address''s to >>a single IP internal address. I am wondering how to limit access based >>on the source IP address. >>ex. >> EXT IP 1 access only to port 25 >> EXT IP 2 access only to port 443 >> EXT IP 3

Hi ! I have setup a complete shorewall now with DMZ, and Private zones and masq, rules, port-forwarding etc. worx like expected. BUT I have a wish to use a couple of more public IP''s and relate those to inernal servers on the DMZ zone and i am now so confused about it. I have searched this archive for SNAT port allow Setup: 3 public adresses on the WAN nic. lets call them 80.80.80.80 -

Hi, Could not conceive an working set-up for an IPSEC VPN made with racoon/setkey on which I have one address on my side acting as an SNAT router for all traffic from my network to a network segment on the far side. my network --- my gateway ---------------------- remote network 10.0.0.0/24 - 10.0.0.1 (10.253.0.2) -- tunnel - 192.168.0.0/22 All traffic starts on my side, so if I can

More than one of our docs issues revolve around some confusion between "IP masquerading" and "SNAT" -- a confusion I might share, or if contagious, I may be catching. <g> I think of SNAT more or less as a special case of IP masquerading, applicable when, for example, the external interface has multiple IP''s and you choose to _explicitly_ set the address through

Hi all, I''m using Shorewall since one year (1.4, then 2.0) I''m trying to migrate a linux firewall from iptables rules to shorewall. The firewall has three zones - net internet - loc1 lan - loc2 second lan I have a lot of rules like this, to SNAT the ip addresses of some computers on loc1 (192.168.16.0/24) when they connect to loc2 (10.0.0.0/8) iptables -v -t nat -I

Dear All, I have configured Cluster Suite with 2 servers Server 1 : 192.168.13.110 IP Address Server 2 : 192.168.13.179 IP Address Floating : 192.168.13.83 IP Address (Assumed by currently active server) I want all snmp packets going out through the active server to be stamped with floating IP So i have added a iptables rules as "iptables -t nat -A POSTROUTING -p udp -s

I am having problems making RTSP connections to a Windows Streaming Media Server (ie "connecting to media...." but WMP never connects). There are no error messages in /var/log/messages. It was suggested to me that SNAT might perform better than MASQ in this respect. I edited my shorewall/masq file as such: eth0 eth1 12.34.56.78 or should it be? eth0 10.0.0.0/24

Sorry for the long descritpion of the problem, I''d like to know If I misunderstand something or if I meet an intrinsic limit of my setup. 217.58.51.162 HDSL eth1 - SRV_XP: 192.168.254.10 eth0: 192.168.254.1 -----+------------------+------- 81.121.243.250 ADSL eth3 - I want to allow incoming pptp request (port 1723) to be forwarded to srv_xp

Has anyone managed to combine bridged network model and SNAT? I have a machine that just ssh''s into other boxes and updates via rsync a copy of their filesystems. I figured I could stage a xen VM for this server with a private IP address and do SNAT and "routing" via the dom0 box, but I get a wierd "Performing cross-bridge DNAT requires IP forwarding to be enabled"

Hello I will briefly draw the situation Router with one interface eth0 , to local network 10.123.0.0/16 on a local network ADSL modem with IP 10.123.10.11 I want to use 10.123.10.11 as a connection to internet . Because of that I have created default route "ip route add default via 10.123.10.11 dev eth0" I do not want my ADSL modem to do NATing , since it shows to be slow. I have

Hi, I am unable to get my LAN masqueraded using SNAT with CentOS 5.3 and iptables. I have the following setup: eth0: connects to internet with static public IP 1.2.3.1 (obscured here for privacy) eth1: connects to DMZ with static public IP 1.2.3.2 (obscured here for privacy) eth2: connects to LAN with static private IP 192.168.0.1 Traffic to hosts in the DMZ/Internet through eth0/1 work fine.

Hi List, I am running into a problem where I have 2 interfaces bridged with and ip address assigned. I have another interface in which traffic has ingress traffic that needs to go out the bridged interface. I am trying unsuccessfully to SNAT the traffic leaving the bridge interface to its assigned address. # brctl show xbrdg0 bridge name bridge id STP enabled interfaces

Hi! First of all, let me say a big "thank you" to Tom for creating shorewall. I''ve been using it for a few months now and it''s such a relief to not have to resort to OpenBSD''s pf (which is so much more sane than Linux'' iptables madness) for the most basic firewalling tasks. I have a question that I didn''t seem to be able to find in the FAQ.

https://bugzilla.netfilter.org/show_bug.cgi?id=851 Summary: IPv6 SNAT target with --random doesn't work Product: netfilter/iptables Version: unspecified Platform: x86_64 OS/Version: All Status: NEW Severity: normal Priority: P5 Component: NAT AssignedTo: netfilter-buglog at lists.netfilter.org

Hi! I''ve been searching the net for information about this topic, but I can''t find anything relevant to my problem or I don''t understand the answer completely. Please enlighten me... :-) I''m trying to replace a Cisco PIX firewall with a Linux Shorewall box. Today the users behind the Cisco FW is on a NAT-network and in the same network there are a couple of

https://bugzilla.netfilter.org/show_bug.cgi?id=1255 Bug ID: 1255 Summary: nftables SNAT is not working Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: critical Priority: P5 Component: kernel Assignee: pablo at netfilter.org

Hi all, i got the following configuration: * NET1: DSL Line with /28 network, let''s call it 10.1.0.0/28 * NET2: DSL Line with /28 network, let''s call it 10.2.0.0/28 * INTNET: Internal Network with productive servers and workstations, 192.168.1.0/24 Obvisiously the 10er networks are official networks but censored to protect my customer. The routerbox assigns on eth0 all

Hi gurus, I need a way to do SNAT based on source mac before routing. This is because hosts attached to my gateway can have duplicate IP addresses, and I have to distinguish over them. I tried to use the nat tool that comes with iproute2, but this force to make a mapping only address to address, and I wanted to do it by mark (I also use iptables to do that). For example, I tried to

Hi, I configured a router box to use 2 providers, as described in the HOWTO. (Apendix 1) I want to use both links to reach a single smtp server. As I read in the kptd and in some old messages of this list, doing a SNAT in the postrouting chain comes _after_ the routing desision. So I guess the following lines I''m trying to use are wrong. (See Apendix 1) What can I do to have multiple

hi, in the masq file''s documentation, there is a sentence: "If you have a static IP on that interface, listing it here makes processing of output packets a little less expensive for the firewall." this realy means that SNAT to the primary address is less expensive than a MASQ rules in the netfilter? is this documented anywhere in iptables/netfilter? thanks. -- Levente