LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 05-07-2003, 05:21 PM   #1
mcleodnine
Senior Member
 
Registered: May 2001
Location: Left Coast - Canada
Distribution: s l a c k w a r e
Posts: 2,731

Rep: Reputation: 45
Multiple 'public' ip addresses


Has anybody here successfully used multiple public (wan/external) IP addresses on a firewall box? I need to build such an animal and not sure which appraoch to use. I need this to enable a very sloppy static IP change by my ISP who has alotted an 8 hour window for address change that will take place soon. The idea is to have both the old and the new address available so that there is little or no downtime during the changeover period.

Currently I have a public addy that is NAT'd to the internal network
Code:
$public_1 1.1.1.1 --> NAT <--> Internal_private
I was thinking of
Code:
$public_1 -- 1.1.1.1  --\
                         ==>  $fake_public -->NAT_internal <--> Internal_private
$public_2 -- 2.2.2.2  --/

Or do I need a separate itables setup for each public IP?

Last edited by mcleodnine; 05-07-2003 at 05:22 PM.
 
Old 05-07-2003, 07:47 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,005
Blog Entries: 11

Rep: Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903
Gidday!

Just to understand better what's going to happen...

There's going to be two interfaces of some kind
on your NAT box, and you will utilize them concurrently
for the time of an 8 hour window? Or is it that they
will switch you from one to the other but couldn't
tell you when in that 8 hour window it's going to
happen?

Cheers,
Tink
 
Old 05-07-2003, 07:56 PM   #3
mcleodnine
Senior Member
 
Registered: May 2001
Location: Left Coast - Canada
Distribution: s l a c k w a r e
Posts: 2,731

Original Poster
Rep: Reputation: 45
Actually there's only one physical interface, just using the ip aliasing (ifconfig eth1:1). I'll be using both addresses (old and new IP) and then bring the old one down when the new one is functional.

As for the timeframe - yeah they're just saying that the switchover will happen _sometime_ in that window.

The other (newly apparent) reason I need to do this is that I'm also running name servers on these IPs. I've got the TTL's for all domains we serve set to ten minutes so that nothing gets cached until the change is complete and comitted.
 
Old 05-09-2003, 03:04 AM   #4
mcleodnine
Senior Member
 
Registered: May 2001
Location: Left Coast - Canada
Distribution: s l a c k w a r e
Posts: 2,731

Original Poster
Rep: Reputation: 45
Managed to sneak it though. I had the unfortunate circumstance (bs speak for 'poor plannig') of having my name servers aprt of the ip address change. THe long and the short of it, I cheated an iptables entry into smoothwall 2.0 so that I could at least get dns to resolve properly until the root servers get updated. "Bad admin. No Starbucks for _you_!"

Added an alias eth1:1 with the old IP and used the new IP for eth1. The following snippet was for the old IP addy. This should not have worked, but it apears to.
Code:
iptables -t nat -A PREROUTING -i eth1 -p UDP -d ex.ter.nal.ip --dport 53 -j DNAT --to in.ter.nal.ip:53
iptables -A FORWARD -i eth1 -o eth0 -p UDP -d in.ter.nal.ip --dport 53 -j ACCEPT
Shameless hack and not really what iptables is all about, but the mail is barfing in now at a nice clip after being offline for, oh... six hours. I would have fired me in a heartbeat. Maybe I should just get back into construction. Decent wage, coffee breaks, travel, no firewalls...

Last edited by mcleodnine; 05-09-2003 at 03:06 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Howto Assign Multiple Static Public IP Addresses under SBC's PPPoE Static Ip system o trekgraham Linux - Networking 8 04-17-2007 11:51 AM
Multiple IP Addresses mikemrh9 Linux - Networking 6 05-26-2005 06:15 AM
multiple ip addresses on 1 nic? houler Linux - Networking 4 04-26-2005 04:53 PM
Multiple IP addresses james_cwy Linux - Newbie 6 06-14-2004 12:34 AM
Multiple IP Addresses meshcurrent Linux - Networking 1 10-12-2002 06:11 AM


All times are GMT -5. The time now is 03:15 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration