Linux

Ask something
Discussion Locked

Linux -Firewall-Router

0 helpful
9 replies

by ratherbfishing 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have been looking at scripts for Linux as firewall - router, but need a bit for information for what I would like to do. Is this possible to do:

Setup three ethernet interfaces, two internal and one external. External goes to DSL Internet connection. One internal is private subnet 192.168.10.1. The other internal are public IP's that need to be behind firewall also, 66.13.x.x.

Can I masquarde (or NAT) from the 192.x.x.x interface to the external, and at the same time not masquarade the 66.13.x.x? And also route between the two internal nets? In other words I want this:

Two nets behind firewall that both access the Internet, and are routed between each other. The 192.168.x.x needs to be masquaraded, and the 66.13.x.x does not.I am not looking for exact instructions, and am somewhat familiar with IPChains, Masquarading and IP forward. Just would like to know if it is possible.

I know that with my current NT based firewall, once you implement NAT it has to be for all interfaces.

Thanks!

9 replies

by peter marshall

I have implemented what you describe with a slightly different architecture.

I run my firewall (Checkpoint Firewall 1) on a Solaris 7 box with three ethernet interfaces. They are dedicated to an external interface, internal subnet and DMZ.

The internal network has an address range 192.168.101.XXX
The DMZ has an address range 192.168.122.XXX

Each machine in the DMZ for which external access is required is allocated a real world IP address. NAT has been implemented on the firewall so that if a packet comes in for a particular IP address (eg mail server 203.53.199.20 (not real)) it will be translated to the ip address of the mail server in the DMZ (192.168.122.16).

As external access is not allowed into the internal network there is a generic NAT that presents all machines here as a single IP address.

With this setup I have no trouble routing between the subnets.

What you want to achieve is possible. As stated we use slightly different architecture, and I am not very familiar with IP chains so I can't comment on whether IP chains is suitable.

Good Luck
Peter

by cpfeiffe

I also use Check Point on Solaris, but for experimental purposes have done Check Point on Linux and used native Linux firewall/NAT/routing in comparisons. Everything you want to do is possible with the native Linux apps. You can NAT via an interface or via a range of addresses and do not have to include all interfaces once you do so. I had better control of the firewall overall and less break points with Check Point, but the native Linux does work as a good deterrant.

Good luck.

by ryan

Absolutely. Possitively. I could go into a dissertation, but I think this link will get you going in the right direction:

http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO-7.html

Your network with real public addresses that needs to be firewalledoff the same box as the internal network is, by strict definition, a DMZ. If this link doesn't get you there, post back.

This discussion is closed to new replies.