Hi Ruth, I will answer as best I can the parts I'm familiar with for you. I used to have a static /28 subnet with a prior ISP so I have experience with some of these points.
With the default server your questions lead me to believe that you are
presuming that you cannot keep on having shorewall take over the routers
job here and preform the same job, every NAT rule is separate and can
either specify an IP address or specify and IP and port such that you
can easily have some odd ports go to one location and the remainder go
to a default endpoint. The way to go about this in shorewall would be
about the order you place the rules in the file, with a few exceptions
noted in the documentation (like tcrules) iptables rules are first match
wins, this means if you wrote your shorewall rules like this it would work.
1 DNAT net loc:IP1 tcp 25
- &netiface
2 DNAT net loc:IP2 tcp 80
- &netiface
3 DNAT net loc:DEFIP - -
- &netiface
You can use the IP instead of &ifname if you prefer it simply expands to
the primary IP address on ifname which is useful if there is any chance
that the IP address could change or just for readability. Do note the
ordering is important when any of these rules match the packet is done
so you need your most specific/highest priority rules first and lower
priority wide defaults last.
On 04/03/13 20:53, Ruth Ivimey-Cook wrote:
> Unwound my work stack to carry on with this...had a chance to review the
> docs again and there's one point I'm not sure about. For clarity, the
> question was about using a Zyxel modem in Bridge mode, which
> automatically disables NAT and how to configure shorewall to take over
> the role.
>
> Tom Eastep wrote:
>> On 02/25/2013 09:50 AM, Ruth Ivimey-Cook wrote:
>>> I think I have to add an entry to "masq" like this to enable NAT, where
>>> the first IP is my internal net block and the second is my main internet IP:
>>> eth2 192.168.1.0/24 82.62.47.198
>>>
>>> Is that all I need to do to emulate what my modem's NAT is doing now?
>> Should be.
> My router has a "default server" in its NAT setup. NATs everything on
> 192.168.1.0/24 but has a default server set as 192.168.1.2. This is
> needed because my internal network runs on another IP block - say
> 192.168.8.0/24 - so that only the "DMZ" zone between the router and the
> firewall is 192.168.1.0/24.
>
> I'm thinking that essentially I loose the 192.168.1.0/24 zone because
> what is left of it will be firewall-internal, but I'm not sure, and in
> any case how do I talk to the modem if it's no longer got an IP?
>
> So: if I do need both IP zones, is the old default server setting still
> necessary, and how to I talk to the modem config if it no longer has an
> IP of its own?
>
> Sorry, rather confused as you can see,
> Ruth
>
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
