[ale] Firewall design

[James P. Kinney III]

On Wed, 2005-06-01 at 08:48 -0400, Christopher Fowler wrote:
> On Wed, 2005-06-01 at 00:50, Bob Toxen wrote:
> > On Tue, May 31, 2005 at 04:17:14PM -0400, Joe Steele wrote:
> > > On Tuesday, May 31, 2005, Christopher Fowler wrote:
> > > >
> > > > Is there a way I can plug a Linux box between E-Deltacomm and my Cisco
> > > > switch and have it do filtering but not have an IP address on either
> > > > eth0 or eth1.  This could be an invisible inline firewall thingy :)
> > 
> > > What you describe is an ethernet bridging firewall.  
> > > Take a look at http://ebtables.sourceforge.net/
> > There's really no need for that.
> > 
> > Just set up your Linux firewall with the "real" IP.  Then set up its
> > inside network to be IP Masqueraded (NAT'ed).  Then give your inside
> > systems 10.x.x.x or 192.168.x.x addresses and forward port 80, etc.
> > to them.
> 
> Thats the problem.  We have 16 public IPs and I want all our application
> server(s) to have a public IP each.  I do plan on having a private
> segment. 

So you have one real IP on the firewall box and virtual IP's that are
directly routed to the real box's private IP.

"iptables -t NAT -I PREROUTING -d <public IP> -j DNAT --to-destination
<private IP>"

There will be no filtering at all on this.

Then add a back route:
"iptables -t nat -I POSTROUTING -s <private IP> -j SNAT --to-source
<public IP>"

It would be good to modify those rules by making a series of tables that
filters out the crap before just routing all the bandwidth to the work
machines.
> 
> If I wanted to place them all on privates I would just ask for one
> public IP from E-Deltacomm. 
> > > --Joe
> > Bob
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://www.ale.org/mailman/listinfo/ale
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part