Dual External DHCP IP's and Firewalling

Maffuster · n00b Joined: 03 Jun 2004 Posts: 38

Alright. Let's see if I can get this across properly.

My ISP gives me two dynamic DHCP allocated IP addresses. I want to be able to do something like the diagram below.

woolsherpahat · Guru Joined: 09 Mar 2004 Posts: 347

Alright, to restate the question, you're trying to have two interfaces (one DMZ, one private), both with internet accessible IPs, mapped through one cable modem?

Maybe:

Maffuster · n00b Joined: 03 Jun 2004 Posts: 38

The box in question will have four interfaces. 1 & 2 will be external, 3 will be DMZ and 4 will be Internal.

My Cable modem (which isn't an interface) can provide me with up to two IP addresses. I want each external interface to grab a DHCP address from my ISP (this is why I need two...if it was static, I'd just assign both IP's to one interface). Then I need to know how (if possible, which I'm sure it is) to route traffic based on ports between the external interfaces and the internal ones.

Example:

Say External #1 was 20.0.0.1 and External 2 was 20.0.0.2
DMZ is 10.0.0.1/24 and Internal is 11.0.0.1/24

I want All internal traffic to go out over 20.0.0.1
I want All DMZ traffic to go out over 20.0.0.2
I want Port 80 on 20.0.0.1 to go to 10.0.0.2
I want Port 80 on 20.0.0.2 to go to 10.0.0.3
I want Port 25 on 20.0.0.1 to go to 10.0.0.2
I want port 2982 on 20.0.0.2 to go to 11.0.0.5

fvant · Posted: Thu Dec 23, 2004 10:51 am Post subject:

what you want seems possible but what is it you need help with ?

Selecting a FW package that provides all this out of the box ?
Are you stuck with particular settings in your own script ?

Maffuster · n00b Joined: 03 Jun 2004 Posts: 38

I'm looking for more of a howto than anything else.

I can assign all the interfaces no problem, it's the routing and ipchaining between them that I'm a bit rusty on.

DarKRaveR · Posted: Thu Dec 23, 2004 6:02 pm Post subject:

Well, you will hav to read quite some documentation, that is for sure ....

And yes, it is all possible.

http://www.netfilter.org/

Maybe you need the LARTC HowTo as well.

If you have explicit questions, you should ask those, but in general you can easily do things like:

iptables -t nat -A PREROUTING -i eth0 --dport 80 -j DNAT --to internalip:port

Rewrite destination adress before routig the packet, that come in on eth0 for port 80 to an internal ip+port

There's lots more (source natting for example) and so on.

As soon as ou want to make decisions on port and complicated matching you will use iptables, otherwise policy based routing might partly be sufficent.

EDIT:

I want All internal traffic to go out over 20.0.0.1
I want All DMZ traffic to go out over 20.0.0.2

Policy based source adress routing - you will need advanced routing in the kernel, install iproute2 and set up two different default gateways based on the source adresses of the packets - Advanced routing howto describes that in depth ....

I want Port 80 on 20.0.0.1 to go to 10.0.0.2
I want Port 80 on 20.0.0.2 to go to 10.0.0.3
I want Port 25 on 20.0.0.1 to go to 10.0.0.2
I want port 2982 on 20.0.0.2 to go to 11.0.0.5

All done with DNAT... example see above

Remeber, when you DNAT the packet, the answer packet needs to be SNATTED so externally it looks like it came FROM the Box itself, not the DMZ/internal net. Maybe plain stupid masquerading might help here already .... maybe in certain cases you might want to explicitly SNAT. In your case you might need state matching and connection tracking ....

Maffuster · n00b Joined: 03 Jun 2004 Posts: 38

Many thanks! I think that should be enough to get me started.

The one question I do have that's specific...

Is there going to be a problem because my two external IP's will change?

Thanks again!

DarKRaveR · Posted: Thu Dec 23, 2004 6:59 pm Post subject:

yeah, might make it more difficult, maybe you need to set up the iptables rules via some post up script and remove them after bringing it down ... but maybe you can work around that .....

Maffuster · n00b Joined: 03 Jun 2004 Posts: 38

Gotcha. They don't change often ~6months or so, but if I need to do more than just reboot to change it, then it could quickly become a pain in the ass

Taladar · Posted: Thu Dec 23, 2004 7:13 pm Post subject:

The worst case would need a restart of the network interfaces or a call to the script setting your rules. A reboot should never be necessary.

If the Interfaces were PPP you could set the rules in /etc/ppp/ip-up.local
but I don't know if there is a similar mechanism with the commonly used dhcp clients. You should look for a dhcp client that allows you to execute scripts after the IP changes.

nobspangle · Posted: Thu Dec 23, 2004 11:07 pm Post subject:

Just use shorewall to configure your iptables. Shorewall maps the interfaces to "zones" you can then use the zones to describe your rules,

You can also choose to masquerade the two subnets (dmz and loc) over the two inernet interfaces.

The files are very simple to configure and you'll be up and running in no time.