W dniu 2011-08-09 15:09, Chuck Swiger pisze:
On Aug 9, 2011, at 4:57 AM, Marek Salwerowicz wrote:
Right now everything works from the Internet - if I do ssh to xx.yy.zz.170, I
really can connect to host 192.168.0.10 etc.
The problem is that when I want to connect from my 10.0.0.0/24 network (and
even from router) to any DMZ host, using it's public address (any of
xx.yy.zz.{170,172,173} ), I can't connect and in fact I am connecting to the
router.. So I am unable to access my web, mta, ftp servers that are located in
DMZ
It's not working because you configured natd to work against traffic flowing
via vr3, but traffic from your LAN is coming via vr0. While you can change
natd to run against all traffic, it's much better to avoid re-writing purely
internal traffic by setting up a DNS view for your machines in the DMZ which
uses internal IPs rather than the public IPs.
So should I allow trafic from LAN to DMZ and setup my local DNS to
connect to hosts in DMZ using private IPs ?
Or, if you insist upon your DMZ hosts being on externally routable IPs, then go
ahead and configure them with externally routable IPs rather than using natd's
redirect_address, and only do NAT for internal traffic via vr0 instead.
Am I able to configure them with externally IPs only and having eg.
bandwidth control using only one router?
My current setup is that I have separately router, web server and mail
server but If I want to limit bandwidth, I have to do it on proper
machine instead of configuring only one device.
Regards,
--
Marek Salwerowicz
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
