Multiple 'public' ip addresses

mcleodnine · 05-07-2003, 04:21 PM

Has anybody here successfully used multiple public (wan/external) IP addresses on a firewall box? I need to build such an animal and not sure which appraoch to use. I need this to enable a very sloppy static IP change by my ISP who has alotted an 8 hour window for address change that will take place soon. The idea is to have both the old and the new address available so that there is little or no downtime during the changeover period.

Currently I have a public addy that is NAT'd to the internal network

Code:

$public_1 1.1.1.1 --> NAT <--> Internal_private

I was thinking of

Code:

$public_1 -- 1.1.1.1  --\
                         ==>  $fake_public -->NAT_internal <--> Internal_private
$public_2 -- 2.2.2.2  --/

Or do I need a separate itables setup for each public IP?

Tinkster · 05-07-2003, 06:47 PM

Gidday!

Just to understand better what's going to happen...

There's going to be two interfaces of some kind
on your NAT box, and you will utilize them concurrently
for the time of an 8 hour window? Or is it that they
will switch you from one to the other but couldn't
tell you when in that 8 hour window it's going to
happen?

Cheers,
Tink

mcleodnine · 05-07-2003, 06:56 PM

Actually there's only one physical interface, just using the ip aliasing (ifconfig eth1:1). I'll be using both addresses (old and new IP) and then bring the old one down when the new one is functional.

As for the timeframe - yeah they're just saying that the switchover will happen _sometime_ in that window.

The other (newly apparent) reason I need to do this is that I'm also running name servers on these IPs. I've got the TTL's for all domains we serve set to ten minutes so that nothing gets cached until the change is complete and comitted.

mcleodnine · 05-09-2003, 02:04 AM

Managed to sneak it though. I had the unfortunate circumstance (bs speak for 'poor plannig') of having my name servers aprt of the ip address change. THe long and the short of it, I cheated an iptables entry into smoothwall 2.0 so that I could at least get dns to resolve properly until the root servers get updated. "Bad admin. No Starbucks for _you_!"

Added an alias eth1:1 with the old IP and used the new IP for eth1. The following snippet was for the old IP addy. This should not have worked, but it apears to.

Code:

iptables -t nat -A PREROUTING -i eth1 -p UDP -d ex.ter.nal.ip --dport 53 -j DNAT --to in.ter.nal.ip:53
iptables -A FORWARD -i eth1 -o eth0 -p UDP -d in.ter.nal.ip --dport 53 -j ACCEPT

Shameless hack and not really what iptables is all about, but the mail is barfing in now at a nice clip after being offline for, oh... six hours. I would have fired me in a heartbeat. Maybe I should just get back into construction. Decent wage, coffee breaks, travel, no firewalls...