Iptables and DMZ

scroogie · 02-28-2008, 03:01 AM

Hello All

I really really need help on setting up a dmz. I have the following:

eth0 - internal network (*.*.225.20)
eth1 - connect to dsl router (*.*.224.7)
eth2 - dmz (*.*.223.27)

In my dmz I have a web server running apache.

I want to be able to access the webpage from the internet, i have a domain and external dns servers as well as a internal dns server.

What must the iptables look like to forward http request from the internet(eth1) to the dmz (eth2)

Hope this make sense

billymayday · 02-28-2008, 03:09 AM

Try reading this

http://iptables-tutorial.frozentux.net/

win32sux · 02-28-2008, 05:39 AM

Quote:

Originally Posted by scroogie

What must the iptables look like to forward http request from the internet(eth1) to the dmz (eth2)

It should look like any of the port-forwarding illustrations which are available all over the Web.

Something like this (assuming a FORWARD policy of DROP):

Code:

iptables -t nat -A PREROUTING -p TCP -i eth1 --dport 80 -j DNAT \
--to-destination 192.168.223.27

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -p TCP -i eth1 -o eth2 --dport 80 \
-d 192.168.223.27 -m state --state NEW -j ACCEPT