DMZ Question

[Deepak Seshadri]

Hello Daniel & John,

Thank you very much for your replies. Kudos to both of you for somehow interpreting the garbled ASCII art. It is the result of composing an "HTML format" email in Outlook '03.

I created a small subnet of /29 bits subnet mask for the DMZ and added the IPs of the machines in the DMZ to the outside interface of the firewall. I  used DNAT & restricted access to only the intended services on those machines. Everything worked well. Thank you for the prompt replies.

Best Regards,
Deepak Seshadri

  ----- Original Message ----- 
  From: Daniel Chemko 
  To: Deepak Seshadri ; netfilter at lists.netfilter.org 
  Cc: Imran Bashir ; Veena Rao ; Syed Amjad Ali ; Zia Ullah 
  Sent: Monday, October 04, 2004 2:09 PM
  Subject: RE: DMZ Question


  You ASCII arts looks like death!

  In order to 'bind' any number of DNAT addresses to the firewall, you
  have two choices.

  1. Actually bind the IP address to the physical interface, such as:
  ip addr add w.x.y.z/24 dev eth1
  This will then get the DNAT from iptables.
  iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
  ${My_NEW_ADDR}

  2. ProxyARP the IP address (http://www.sjdjweis.com/linux/proxyarp/):
  echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
  echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
  This will then get the DNAT from iptables.
  iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
  ${My_NEW_ADDR}


  There is one to catch when doing this. If you have a single DNS source
  for external and internal machines, you'll have to resolve the machine's
  ip's the external IP. Netfilter will not work performing what I call
  reflective nat out of the box.

  I consider reflective nat to be when you want to connect to a machine on
  your subnet but under a different IP address.

  # You should have something like this line already
  iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
  ${My_NEW_ADDR}

  # Allow traffic to bounce off the interface
  iptables -A FORWARD -o ${IF_DMZ} -o ${IF_DMZ} -j ACCEPT
  # Force the firewall to rewrite the source IP of the packet since
  conntrack refuses to allow SRC->FW->DST->SRC flows
  iptables -t nat -A POSTROUTING --destination ${My_NEW_ADDR} --source
  ${DMZ_NET}/${DMZ_MSK} -j SNAT --to ${FW_DMZ_IP}