helo there, i read the FAQ but you didnt anser my question... what ip/settings do i give the DMZ ehternet card on my firewall box.. so eth0 is the ip x.x.x.67, my mailserver is currently x.x.x.66 ... and this .66 needs to connect to the dmz ethernet card eth1.... so my question still is what do you need to set to eth1 if you want to use section 13 with susefirewall2 if you have public ip boxes on your dmz ethernet... does iptables translate the addresses our does the seusefw2 reroute packets to the dmz ethernet no matter what i set? how is this all working.. this is my question.. i read the FAQs but they didnt explain what to set for the DMZ interface when using public ips from the same subnet on the external eth0 and the dmz eth1... thanks again, andy ---- Original Message ----- From: "Togan Muftuoglu" To: Sent: Monday, August 19, 2002 7:05 PM Subject: Re: [suse-security] how can i have public IPs in the DMZ with SuSEfirewall2

* Andreas Bittner; on 19 Aug, 2002 wrote:

...

subject: how can i have public IPs in the DMZ with SuSEfirewall2

deutscher text weiter unten / german text follows below ----------------

Hello all,

i have been searching around quite a while and couldnt find a solution.

i have 8 public ip addresses from our internet service provider (netmask is 255.255.255.248)

i have a suse 8 linux box with 3 ethernet network cards. eth0 is external connected directly with crossover to the router of the ISP. eth1 is the dmz ethernet card. eth2 is the internal network. should be 192.168.200.x with netmask 255.255.255.0 ... something like that..

now i have read in the SuSEfirewall2 config file in secion 13, that the SuSEfirewall2 supports public IP in the DMZ zone.. even the EXAMPLE file is talking about a scenario with a webserver with ports 80 and 443 running with public ip 200.200.200.200 in the DMZ... in my case i want to run a mailserver in the DMZ with public ip, and it only needs port25 to the internet, and its getting mails only from secific hosts on the internet. so its not included in an mx record anywhere but gets mails from a virus detection/mailscanning companies mailservers there...

from the SuSEfirewall2 FAQ it should give you start

Q: I have set a web server in my DMZ. How do I configure SuSEfirewall2 to let people on the internet access my pages? A: Same principle as above. Lets say your web server has got an official IP address of 1.1.1.1 which you received from your ISP. You would just configure FW_FORWARD_TCP like this: FW_FORWARD="0/0,1.1.1.1,tcp,80"

HTH --

Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

i am not very good at these dmz/ip/routing nd iptables stuff.. and i simply dont understand what i would have to set for my dmz ip.. the mailserver is x.x.x.66 i agree i set/leave it like that.. i set x.x.x.67 for example to the external eth0 card that connects to the isp router that has x.x.x65. eth0 a has mask of 255.255.255.248 right? and what does the DMZ eth1 have? x.x.x.65 for eaxmple with same 255.255.255.248 mask? will susefirewall2 give the packets for .66 to that eth1 card? will this all work? can anyone help how to set the DMZ ethernet card ip/mask/gateway ? isnt anyone using this scenario more frequently? thanks again, andy ----- Original Message ----- From: "Togan Muftuoglu" To: Sent: Monday, August 19, 2002 8:25 PM Subject: Re: [suse-security] how can i have public IPs in the DMZ with SuSEfirewall2

* Andreas Bittner; on 19 Aug, 2002 wrote:

...

helo there,

i read the FAQ but you didnt anser my question... what ip/settings do i give the DMZ ehternet card on my firewall box.. so eth0 is the ip x.x.x.67, my mailserver is currently x.x.x.66 ... and this .66 needs to connect to the dmz ethernet card eth1.... so my question still is what do you need to set to eth1 if you want to use section 13 with susefirewall2 if you have public ip boxes on your dmz ethernet...

well if you are just using one ip why don't you use x.x.x.66/32

...

does iptables translate the addresses our does the seusefw2 reroute packets to the dmz ethernet no matter what i set? how is this all working.. this is my question.. i read the FAQs but they didnt explain what to set for the DMZ interface when using public ips from the same subnet on the external eth0 and the dmz eth1...

--

Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

how about host routes? if you have control over the router yourself, or can talk someone at your ISP to reconfigure it, my prfered config would be host routes. if that fails, you can do arp bridging on the firewall. or use aliases on your firewall outside interface, and use private ips in the DMZ. HTH, lge

OK, now I am not doing this exactly every day, so I may be wrong, but iirc:

...

how about host routes?

I am interested in all your suggestions because I had a similar design problem to that of the OP. How can this work if the NIC that connects to the ISP has to have one of the IP addresses which are part of the whole subnet linked with another NIC on the same machine? (My ISP gave me a separate IP for this purpose.)

this is ugly, but it should work. ( If I am wrong, shout at me :) o.X: official, p.X: private :p.64---p.Y:private LAN / ISP----router o.1----o.2:firewall:p.1----o.3:DMZ host on router: default: ISP host o.2/32 via o.1 host o.3/32 via o.2 host o.4/32 via o.2 etc. host o.Proxy for LAN via o.2 ... last three lines could be replaced by a normal subnet route, net o.0/28 via o.1 since host routes take precedence, so the subnet route is not active for o.2 on firewall: [ LAN normal configuration ] defaul: o.1 host o.1 via o.2 host o.3 (DMZ) via p.1 on DMZ: default: p.1 host p.1 via o.3

...

if you have control over the router yourself, or can talk someone at your ISP to reconfigure it, my prfered config would be host routes.

This is difficult if the ISP won't commit itself to a particular gateway at its end (mine has n routers, where n increases with time).

maybe I did not understand this question. it is the routers job to cope with this, isn't it. regardless of the routing at your site, the ISP side is their problem.

...

if that fails, you can do arp bridging on the firewall.

This sounds like a good idea, is it difficult if the firewall is also acting as a router for 2 different subnets and the ISP, though? (As in OP, and my setup!) you can turn this on/off by interface.

...

or use aliases on your firewall outside interface, and use private ips in the DMZ.

If you do this, are all packets transparently routed between the aliases, or do you have to use masquerading, with all the potential protocol problems, and port forwarding? of course you have to NAT in this case. may or may not be easy...

cheers, lge

On Wednesday 21 August 2002 03:47 am, Kai-H. Weutzing wrote:

Hi,

...

If you do this, are all packets transparently routed between the aliases, or do you have to use masquerading, with all the potential protocol problems, and port forwarding?

I think iptables didn't work with interface aliases because a iptables command on a alias produces a warning like this:

~> iptables -A INPUT -j ACCEPT -i eth0:217 Warning: wierd character in interface `eth0:217' (No aliases, :, ! or *).

Hmmm, Kai, I think you are wrong. Shorewall specifically supports proxyarp which allows you to alias your external nic and handle multiple IPs there on. -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska