IP assignments, routing and NAT

Hi ng,

I want to build up a network with a set of static IP's that my provider
assigned to me. It's a 3-bit subnet of a Class C network address I presume.
So if I let out network (0), gateway (1) and broadcast address (7) there
are five IPs left (e.g. 200.100.200.2 - 200.100.200.6, netmask
255.255.255.248 ).

So far so good.
- I want to make a number of servers available to the internet using the
different static IPs. They are all connected to the other side of the
firewall and I don't want to use Port Forwarding.
- The computer meant to be the firewall between the servers and the gateway
has only two NICs. It's not possible to extend it.

So I want the servers all reside in a private network (e.g. 192.168.0.0) and
make them available via the static IP's through some kind of static NAT
from the firewall/router. So f.e. all requests from the internet for
200.100.200.3 should be sent to 192.168.0.3, all requests for 200.100.200.4
should be sent to 192.168.0.4 and so on. Is such a configuration possible
(iproute2??). And if, how is such a static 1 to 1 address translation
called?

Hope someone can help me...

Cheers,
Max

Hi!

Sure, that's possible and common. Most call it: static-NAT. If you want to
configure it quick, use fwbuilder (Firewall-Builder), it create you rules
for the filtering and masquerading (==NAT).

Have fun, it's cool stuff!!


"M. Hrabowski" <(E-Mail Removed)> schrieb im Newsbeitrag
news:c14dgh$p4o$01$(E-Mail Removed)...
> Hi ng,
>
> I want to build up a network with a set of static IP's that my provider
> assigned to me. It's a 3-bit subnet of a Class C network address I
presume.
> So if I let out network (0), gateway (1) and broadcast address (7) there
> are five IPs left (e.g. 200.100.200.2 - 200.100.200.6, netmask
> 255.255.255.248 ).
>
> So far so good.
> - I want to make a number of servers available to the internet using the
> different static IPs. They are all connected to the other side of the
> firewall and I don't want to use Port Forwarding.
> - The computer meant to be the firewall between the servers and the
gateway
> has only two NICs. It's not possible to extend it.
>
> So I want the servers all reside in a private network (e.g. 192.168.0.0)
and
> make them available via the static IP's through some kind of static NAT
> from the firewall/router. So f.e. all requests from the internet for
> 200.100.200.3 should be sent to 192.168.0.3, all requests for
200.100.200.4
> should be sent to 192.168.0.4 and so on. Is such a configuration possible
> (iproute2??). And if, how is such a static 1 to 1 address translation
> called?
>
> Hope someone can help me...
>
> Cheers,
> Max

> - I want to make a number of servers available to the internet using the
> different static IPs>
> So I want the servers all reside in a private network (e.g. 192.168.0.0)
> and make them available via the static IP's through some kind of static
> NAT from the firewall/router.
> So f.e. all requests from the internet for
> 200.100.200.3 should be sent to 192.168.0.3

The Netfilter rule for this example would be
iptables -A PREROUTING -t nat -d 200.100.200.3 -j DNAT --to-destination
192.168.0.3

To make sure all traffic passes through the fw box to your local net you
need something like
iptables -A FORWARD -i <ext_interface> -d 192.168.0.0/24 -j ACCEPT
or a separate rule for every server on the local net you want to be
reachable from the Internet (assuming packets in your FORWARD chain are
dropped or rejected by default).

Joerg

--
OpenPGP: D14F 2782 1276 EBB4 E4E3 0BF1 838D DD4C EB56 1C99