LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-15-2010, 01:50 AM   #1
longvnit
LQ Newbie
 
Registered: Apr 2008
Posts: 13

Rep: Reputation: Disabled
Question Rules for Firewall


hi, i tried to build a linux firewall using Centos 5.4 but not sucessfully.
Topology:

RangeIP Public <--->Firewall<--->HTTP Server

1. Firewall server includes 2 NIC:
NIC 01 have 2 IP public 64.34.34.1&2
NIC 02 has 1 internal IP 10.0.0.1
2. HTTP Server include 1 NIC
NIC 1: 10.0.0.2

I want to config to every body can access to webserver (10.0.0.2)

Use Iptables, i try to write rules on FireWall Server bellow:
#iptables -t nat -A PREROUTING -t tcp -i eth0 --dport 80 -d <IP PUBLIC> -j DNAT --to 10.0.0.2:80
#iptables -t nat -A POSTROUTING -t tcp -s 10.0.0.2 -j SNAT --to <IP PUBLIC>

But not sucessfully. Please help me !
 
Old 02-15-2010, 02:08 AM   #2
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
What is it that is not working and how can you tell?

Naturally everyone can access the web server if you just turn forwarding on for everyone. Since you are running a firewall, I guess there are some people or some kinds of access you want to block.

Instead of direct IP forwarding, you may want to try IP masquerade - normally used at gatways - or try setting your firewall box as a bridge or transparent proxy.

I wouldn't normally use both pre and post-routing. example of a gateway firewall:
http://www.linuxquestions.org/questi...0/#post2224036
... and an example with masquerade:
http://www.linuxquestions.org/questi...2/#post2790552
... as a bridge:
http://www.linuxjournal.com/article/8172
... transparent proxy:
http://www.faqs.org/docs/Linux-mini/...rentProxy.html

... now, typical free software, you have too many choices.
Happy hacking.
 
Old 02-15-2010, 03:37 AM   #3
Choon Keat
LQ Newbie
 
Registered: Feb 2010
Location: Singapore
Posts: 3

Rep: Reputation: 0
What your forward flag say
/proc/sys/net/ipv4/ip_forward

Also shouldn't you just use the FORWARD chain instead
 
Old 02-15-2010, 04:18 AM   #4
longvnit
LQ Newbie
 
Registered: Apr 2008
Posts: 13

Original Poster
Rep: Reputation: Disabled
/proc/sys/net/ipv4/ip_forward = 0

I want when every body access from internet by IP Public, HTTP traffic will throught firewall into HTTP Server ?
 
Old 02-15-2010, 10:41 AM   #5
Choon Keat
LQ Newbie
 
Registered: Feb 2010
Location: Singapore
Posts: 3

Rep: Reputation: 0
That should be 1
Putting it in the network init script will do it
echo "1" > /proc/sys/net/ipv4/ip_forward

You can also try putting it in your sysconfig file
/etc/sysconfig/network-scripts/ifcfg-eth0 (Referencing redhat here)
FORWARD_IPV4="Yes"
This you will have to test, it changes from distro to distro and version to version
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
firewall rules on OpenSUSE 11.0 noir911 SUSE / openSUSE 3 05-20-2009 04:15 AM
firewall rules sulekha Linux - Networking 2 10-09-2008 02:30 AM
Firewall and NAT rules samplelin Linux - Security 1 06-20-2006 06:22 AM
Firewall Rules studpenguin Linux - Security 0 07-01-2004 03:14 AM
help with firewall rules please deuce868 Linux - Security 1 06-14-2004 03:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:17 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration