On Aug 9, 2011, at 4:57 AM, Marek Salwerowicz wrote:
> Right now everything works from the Internet - if I do ssh to xx.yy.zz.170, I
> really can connect to host 192.168.0.10 etc.
>
> The problem is that when I want to connect from my 10.0.0.0/24 network (and
> even from router) to any DMZ host, using it's public address (any of
> xx.yy.zz.{170,172,173} ), I can't connect and in fact I am connecting to the
> router.. So I am unable to access my web, mta, ftp servers that are located
> in DMZ
It's not working because you configured natd to work against traffic flowing
via vr3, but traffic from your LAN is coming via vr0. While you can change
natd to run against all traffic, it's much better to avoid re-writing purely
internal traffic by setting up a DNS view for your machines in the DMZ which
uses internal IPs rather than the public IPs.
Or, if you insist upon your DMZ hosts being on externally routable IPs, then go
ahead and configure them with externally routable IPs rather than using natd's
redirect_address, and only do NAT for internal traffic via vr0 instead.
Regards,
--
-Chuck
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
