LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-09-2009, 07:43 AM   #1
crontab
Member
 
Registered: Jun 2005
Distribution: Various
Posts: 72

Rep: Reputation: 15
Routing with public IPs


Hello, all.

I have a /24 block of IPs with a few servers currently running on it. What I'd like to do is setup a firewall and put these servers behind it.

Here's where I got yesterday:

1) eth0 is connected to the switch, given the IP .2 and default gateway of .1 (.1 being my /24's gateway)
2) eth1 is connected to a laptop (eventually a server) with the IP .3
3) laptop given a random IP, but the gateway is .3 instead of .1

(subnet gw .1) <--- | [eth0/.2] <---> [eth1/.3] | ---> [laptop/gw .3]

Is this possible, or is there something obvious that I'm overlooking? I tried this out yesterday and couldn't get it working... packets from the servers were being sent out to the internet through eth0 on the firewall, but upon returning, the firewall was not forwarding them back to their originating IP through eth1. Can there even be two gateways on a subnet in a manner similar to this? Can this be done entirely with route, or is iptables necessary?

The only two routes on the firewall were the /24 itself, and the default gw. (Edit: just for clarification, even though I'm calling it a firewall, it's not actually filtering anything at the moment.)

Right now I'm only concerned with the routing aspect and trying to figure out what I did wrong, or even if what I want is possible without having to do further subnetting. The actual firewall implementation comes later.

Thanks, any advice is greatly appreciated.

Last edited by crontab; 02-09-2009 at 07:46 AM.
 
Old 02-09-2009, 01:15 PM   #2
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 891

Rep: Reputation: 184Reputation: 184
The Firewall is also a router. You can't have the same subnet on either side of a router. You can either split the subnet by giving everything a /25 mask. That would give you one network of .0 with hosts .1 to .126, and a second network .128 with hosts .129 to .254. One goes betwen your servers and your firewall and the other goes between your firewall and your router.

What would normally happen is that your servers would have private addressing and the dirty side of your firewall would keep the public /24. You would then NAT on your firewall.

Another alternative is to put a private "transit" network between your router and your firewall, say 10.0.0.0/24. The servers retain use of the public range. The only downside to this is that you won't be able to source any traffic from the transit network out to the internet, but then that doesn't really matter because your traffic is all comming from the public range.
 
Old 02-09-2009, 03:26 PM   #3
crontab
Member
 
Registered: Jun 2005
Distribution: Various
Posts: 72

Original Poster
Rep: Reputation: 15
Thanks for the response. I had a feeling that was the problem, but never having attempted this on a real subnet of public IPs without NAT involved, I wasn't exactly sure. It should be feasible, then, to get a /30 and put eth0 on that subnet's only usable IP, and assign eth1 .1 on my /24?
 
Old 02-10-2009, 06:11 AM   #4
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 891

Rep: Reputation: 184Reputation: 184
Yep you can do that so you would end up with -

Code:
[LAPTOP]----(public-ip/24)-------[Firewall]-------(transit-ip/30)-------[internet router]-----{internet}
       .2                      .1         .1                          .2
You only have to bear in mind that attempts to communicate to the internet sourced from the firewalls transit interface will fail. It snot a problem in normal operation but can cause confusion in diagnostics.

EDIT: Plus you need a route on the internet router for the public ip's via the firewall, if thats not stating the obvious.

Last edited by baldy3105; 02-10-2009 at 06:13 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Firewall for Public IPs Machines saifurab Linux - Security 5 06-07-2007 10:39 AM
Can I use Public IPs on LAN dula Linux - Networking 1 06-07-2007 06:46 AM
NAT + public IPS (+ firestarter) Stefan Pantiru Linux - Networking 2 05-17-2005 05:43 AM
Public IPs behind router Buzer Linux - Networking 2 09-20-2003 01:36 PM
Sharing two public IPs. Unseen Linux - Networking 8 03-20-2003 01:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:06 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration