Iptables: How do I forwarding public IPs into a router inside a private IP network?

Iptables: How do I forwarding public IPs into a router inside a private IP network?

Post by Stephen Hurrel » Sat, 22 Nov 2003 17:35:39



Hello

I have the following 10.0.0.0/8 Linux network behind a linux firewall.
I am using iptables/NAT-MASQ (via arno's firewall script) to do port
forwarding to the WWW, e-mail, etc. servers off one IP. All that works well.

My problem is that I now have to provide internet access into an
internal router that is a gateway to a 10.0.0.0/8 network. I have more
public IPs so I hope there is some way to forward, tunnel or bridge to
do this.

WWW<-->
       (eth0)[Firewall](eth1)<-->(eth0)[WWW Server](eth1)
                                        <--> Internal Network <--> router
                        <--> customer 10.0.0.0/8 network.

In the internal network I have a dial on demand router that is also
doing NAT 10.0.0.0/8. The customer would prefer not to renumber.

-----------

THe Masquerade HOW TO kinda talks doing this with iptables. Does anybody
have an idea that I could try?

Thank You

 
 
 

Iptables: How do I forwarding public IPs into a router inside a private IP network?

Post by Horst Knobloc » Mon, 24 Nov 2003 08:17:34



> I have the following 10.0.0.0/8 Linux network behind a linux firewall.
> I am using iptables/NAT-MASQ (via arno's firewall script) to do port
> forwarding to the WWW, e-mail, etc. servers off one IP. All that works
> well.

> My problem is that I now have to provide internet access into an
> internal router that is a gateway to a 10.0.0.0/8 network. I have more
> public IPs so I hope there is some way to forward, tunnel or bridge to
> do this.

Hm, are you saying, that you currently have only WWW and email
access for your internal network via proxy server(s) to the
Internet, and now you want fullblown Internet access for the
internal network?

Quote:> WWW<-->
>        (eth0)[Firewall](eth1)<-->(eth0)[WWW Server](eth1)
>                             <--> Internal Network <--> router
> <--> customer 10.0.0.0/8 network.

> In the internal network I have a dial on demand router that is also
> doing NAT 10.0.0.0/8. The customer would prefer not to renumber.

I'm still confused about your current network setup. You also gave
too few information about the IP adrs and netmasks.

Is the "Internal Network" above a real network or is it just
a description that from here on your internal net begins?

You talk about an internal router and a dial on demand router
above, are these two routers or are you talking about the same
one?

What sense does it make to have a dial on demand router in
an internal network? Do you have two direct connections to
the Internet, one via the Firewall and a second one via
your dial on demand router?

You see, still lots of confusion here on my side. :-)
I guess you need to better explain and give more information
about your current setup and about what you want to achieve.

Ciao, Horst
--
?When pings go wrong (It hurts me too)? E.Clapton/E.James/P.Tscharn

 
 
 

1. Public access to Cyrus-Imap server residing inside the private network

Hi,

We have a private network that accesses internet via masquerading
facility. I am trying to setup a Cyrus-Imap server on a server
that sits inside the private network. We are virtual hosting a few
domains and need to provide mail access to them all. I would
like some help and feedbak on what is the best route to accomplish
our objectives. Here is our setup:

    -------------
   /  Internet   \           |~~~~~|
   |              <----------|  A  |
   \____________/            |_____|
                                / \
                                 |
     ----+------------+----------+---------+
        / \          / \                  / \
         |            |                    |
      |~~~~~|      |~~~~~|              |~~~~~|   <- Private
      |  X  |      |  Y  |  ..........  |  Z  |      Network
      |_____|      |_____|              |_____|

A: Has both DNS and web server running (no firewall)
X: Cyrus_Imap Server
Y: Planned LDAP server
Z: Database server

Questions:
1). What is the best way to route all the mail messages coming
to  host A (which is a host to several virtual domains ) to
Cyrus-Imap server at host X.
        - Can this be accomplished just by sendmail or should
          I look into a router or firewalls?

2) What configuration changes need to be done to either the
hosts or applications (Sendmail and or Cyrus-Imap server) such
that users of various domains can access their mail residing
on Host X via Host A and appear as though it is coming from
their own respective domains.

Any leads or pointers to either published material (such as
faqs or howtos) or news groups' discussions would be greatly
appreciated.

Thank you
__
Seva

2. ATI Rage Mobility P at 1400x1050 works with Mandrake 8.1

3. IPTables not forwarding from public to private subnet.

4. 2.5 weirdness

5. forwarding between private and public networks

6. Where is the FAQ

7. Connect public IP from inside - IPTables

8. Changing TimeZone

9. Routing Problem (Public-->Public Addresses over Private IP Addresses)

10. iptables - forward public static ip to NAT host

11. Perplexing IMAP problem with private & public IPs

12. Routing public IPs on private LAN

13. Help: Map private IP to public IP