All of lore.kernel.org
 help / color / mirror / Atom feed
From: Chris Wilson <chris@netservers.co.uk>
To: "Coutts, Ashe (Testing Account)" <ATest@sbsdk12.org>
Cc: netfilter@lists.netfilter.org
Subject: Re: Not quite understanding DNAT
Date: Fri, 25 Jul 2003 10:47:30 +0100 (BST)	[thread overview]
Message-ID: <Pine.LNX.4.44.0307251045220.1760-100000@localhost> (raw)
In-Reply-To: <3F1FA56E.28480.E59161E@localhost>

Hi Ashe,

> I have set up a very basic firewall for our system. 
> We have 126 addresses to be used to/from the outside world (204.48.178.0/25) 
> and are using 10.x numbers on the inside.
> 
> It is working almost as I expected except for the following. The DNAT 
> connections come into the system fine but are seen as originating from the 
> eth0 interface rather than their eth0:x interface. So, when attaching to a linux 
> cpu with ssh I am needing to place the ip# for the eth0 interface in the 
> hosts.allow file rather than the much more restrictive eth0:x ip#. Can it be set 
> up so the connection is between the external eth0:x ip# and its linked internal 
> ip#?

You could try:

	route add <internal-server-10.0.0.x> dev eth0 \
		gw <address-of-eth0:x>

Using an address of your own box as the gateway of a route will cause
locally-generated traffic going down that route to come from that address,
instead of the default address on the device. This should mean that the
masquerading uses that address too, but I haven't tested it.

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |



  parent reply	other threads:[~2003-07-25  9:47 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-07-24  7:00 DNAT question Rio Martin.
2003-07-24  8:29 ` Philip Craig
2003-07-24  8:56   ` Rio Martin.
2003-07-24  9:42     ` Chris Wilson
2003-07-24 13:37       ` Gonzalez, Federico
2003-07-24 14:16         ` Cedric Blancher
2003-07-24 16:22     ` Not quite understanding DNAT Coutts, Ashe (Testing Account)
2003-07-24 16:43       ` Aldo S. Lagana
2003-07-25  0:14       ` Philip Craig
2003-07-25  9:47       ` Chris Wilson [this message]
2003-07-25 10:10         ` Cedric Blancher
2003-07-24 17:14 Daniel Chemko
2003-07-24 17:47 ` Ramin Dousti
2003-07-24 22:06 George Vieira

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Pine.LNX.4.44.0307251045220.1760-100000@localhost \
    --to=chris@netservers.co.uk \
    --cc=ATest@sbsdk12.org \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.