Sorry about the numbers there I added them as I was planning to write an explanation of each then decided it probably wasn't required and forgot to remove them. Oh well they serve as identifiers if anyone has any further queries related to them.
On 04/03/13 23:09, Matt Joyce wrote: > Hi Ruth, I will answer as best I can the parts I'm familiar with for > you. I used to have a static /28 subnet with a prior ISP so I have > experience with some of these points. > > With the default server your questions lead me to believe that you are > presuming that you cannot keep on having shorewall take over the routers > job here and preform the same job, every NAT rule is separate and can > either specify an IP address or specify and IP and port such that you > can easily have some odd ports go to one location and the remainder go > to a default endpoint. The way to go about this in shorewall would be > about the order you place the rules in the file, with a few exceptions > noted in the documentation (like tcrules) iptables rules are first match > wins, this means if you wrote your shorewall rules like this it would work. > > 1 DNAT net loc:IP1 tcp 25 > - &netiface > 2 DNAT net loc:IP2 tcp 80 > - &netiface > 3 DNAT net loc:DEFIP - - > - &netiface > > You can use the IP instead of &ifname if you prefer it simply expands to > the primary IP address on ifname which is useful if there is any chance > that the IP address could change or just for readability. Do note the > ordering is important when any of these rules match the packet is done > so you need your most specific/highest priority rules first and lower > priority wide defaults last. > > On 04/03/13 20:53, Ruth Ivimey-Cook wrote: >> Unwound my work stack to carry on with this...had a chance to review the >> docs again and there's one point I'm not sure about. For clarity, the >> question was about using a Zyxel modem in Bridge mode, which >> automatically disables NAT and how to configure shorewall to take over >> the role. >> >> Tom Eastep wrote: >>> On 02/25/2013 09:50 AM, Ruth Ivimey-Cook wrote: >>>> I think I have to add an entry to "masq" like this to enable NAT, where >>>> the first IP is my internal net block and the second is my main internet >>>> IP: >>>> eth2 192.168.1.0/24 82.62.47.198 >>>> >>>> Is that all I need to do to emulate what my modem's NAT is doing now? >>> Should be. >> My router has a "default server" in its NAT setup. NATs everything on >> 192.168.1.0/24 but has a default server set as 192.168.1.2. This is >> needed because my internal network runs on another IP block - say >> 192.168.8.0/24 - so that only the "DMZ" zone between the router and the >> firewall is 192.168.1.0/24. >> >> I'm thinking that essentially I loose the 192.168.1.0/24 zone because >> what is left of it will be firewall-internal, but I'm not sure, and in >> any case how do I talk to the modem if it's no longer got an IP? >> >> So: if I do need both IP zones, is the old default server setting still >> necessary, and how to I talk to the modem config if it no longer has an >> IP of its own? >> >> Sorry, rather confused as you can see, >> Ruth >> > > > > ------------------------------------------------------------------------------ > Everyone hates slow websites. So do we. > Make your web apps faster with AppDynamics > Download AppDynamics Lite for free today: > http://p.sf.net/sfu/appdyn_d2d_feb > > > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
