Re: [fw-wiz] Non-NAT Firewall

From: Sigurd Urdahl (sigurdur_at_linpro.no)
Date: 11/11/05

  • Next message: Nathaniel Hall: "Re: [fw-wiz] Non-NAT Firewall" 
    To: firewall-wizards@honor.icsalabs.com
Date: 11 Nov 2005 00:15:44 +0100

    Nathaniel Hall <nathaniel.d.hall@gmail.com> writes:

    > Alright, this is a bit tough to explain, so I will try my best.
    >
    > I am currently running a CheckPoint-NG firewall with three interfaces.
    > Interface 1 goes to DMZ 1 (public IP addressing and Internet facing),
    > interface 2 goes to DMZ 2 (public IP addressing) and interface 3 goes to
    > the internal network (private IP addressing). The CheckPoint FW does
    > not peform NAT. That allows me to review logs of servers in DMZ 1
    > without having to figure out what internal IP as NATed.
    >
    > Now, for my problem. I would like to be able to have the same
    > functionality using NetFilter, but I have not been able to figure out
    > how to do this without masquerading or using DNAT and SNAT. Any ideas?

    I don't get it. You say the CP box doesn't do NAT. But I assume you
    still have the internal clients accessing the Internat NATed?

    If what you want is to have traffic from the internal net not be NATed
    if going to one of the DMZ's, but NATed if going to the internet you
    should probably be able to do something like this:

    iptables -t nat -A PREROUTING -i eth2 --destination $DMZ1 --source $INTERNAL -j ACCEPT
    iptables -t nat -A PREROUTING -i eth2 --destination $DMZ2 --source $INTERNAL -j ACCEPT
    iptables -t nat -A PREROUTING -i eth2 --destination $DMZ1 --source $INTERNAL -j DNAT --to $EXTERNAL_IP

    with $DMZ1, $DMZ2 and $INTERNAL being the different nets, e.g
    10.12.25.0/24 and $EXTERNAL_IP being the address on the firewall that
    you want the clients to come through when going out on the
    Internet. And of course you'll have to adjust the targets, you most
    likely will want to jump to a chain with rules instead of to
    ACCEPT. And make those chains end in a DROP or something, otherwise
    packets might fall through and hit the DNAT-rule.

    Disclaimer: I haven't tested that this actually works (need to rebuild
    that testbox:-), but at least iptables doesn't complain when I try
    to add that kind of rules to my workstation.

    kind regards,

    -sig 

    -- 
Sigurd Urdahl                           sigurdur@linpro.no
Systemkonsulent og sånt        Systems consultant and such
Linpro A/S                           http://www.linpro.no/
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Nathaniel Hall: "Re: [fw-wiz] Non-NAT Firewall"

    Relevant Pages

    • Re: avast
      ... > Just did a clean installation of xp pro sp1 and download 'avast anti ... Did you firewall before connecting to the internet? ... Internet and patch with the critical updates? ... Why you should use a computer firewall.. ...
      (microsoft.public.windowsxp.general)
    • Re: XP NOT RESPONDING
      ... Did you have a firewall going before connecting to the internet? ... Microsoft has these suggestions for Protecting your computer from the ... Why you should use a computer firewall.. ... are pay - some you can only download if you are registered - but it is best ...
      (microsoft.public.windowsxp.setup_deployment)
    • Re: Guide to secure installtion of IIS 5
      ... don't forget a well-configured firewall. ... Do not put the computer onto the network or the Internet until after the ... Follow the instructions for hardening Windows and IIS at ... Install all service packs and security fixes from Microsoft and otherwise ...
      (microsoft.public.inetserver.iis.security)
    • Re: Security Alerts Driving Me INSANE!
      ... The only reason, really, that you need a firewall and antivirus software is ... because you use the Internet with your computer. ... cleaned up and considered a hardware upgrade or three. ...
      (microsoft.public.windowsxp.security_admin)
    • RE: firewall
      ... You need to do a lot of reading about ipfw ... IPFW is the only firewall available to FBSD, ... rules do not function correctly on a DSL or cable internet ... @320 pass in quick on rl0 proto tcp from 63.70.155.0/24 to any port ...
      (freebsd-questions)