RE: iptables configuration help

Two more things to look at:

In one of your previous posts you mentioned that you were getting an error on
the iptables rules you added. Make SURE that your commands are on one line.
Some text editors have a nasty habit of forcing a word wrap that when saved is
interpreted by linux as a carriage return and therefore sees the two parts of
your command as seperate.

Secondly, you should register on http://community.smoothwall.org/forum if you
post questions there you'll get more responses and most likely get some
feedback from guys who know SW like the back of their hand.

Rgds,

Alistair Francis
Systems Administrator
Comm Express Services SA (PTY) LTD
TEL:    +27 (0)11 475-5567
FAX:   +27 (0)11 475-6238
CELL: +27 (0)82 608-0181


The information contained in this electronic mail message is confidential to
the Matragon group of companies and may enjoy legal privilege. The contents
are intended solely for the addressee and access thereto by anyone else is
unauthorised. Should you not be the intended recipient, kindly delete the
message and inform us. Any disclosure, copying or distribution is prohibited
and may be unlawful. Please also note that any action taken, or omitted to be
taken in reliance on the information contained herein is done at your own
risk.

  -----Original Message-----
  From: Vijay Kumar [mailto:vijay-d+bK1eGgz2KBUy7/[email protected]]
  Sent: 05 November 2004 17:25
  To: Alistair Francis
  Subject: RE: [gpl] iptables configuration help


  Hi,

  In my current smoothwall:

  eth1 = RED
  eth0 = GREEN
  eth2 = DMZ

  I used ifonfig eth1:0 up to add the sub-interface after which the stpes as
mentioned to you earlier email.

  Kindly let me know if I am missing anything.

  Regards,
  Vijay Kumar.


  On Fri, 2004-11-05 at 19:04, Alistair Francis wrote:
    o;?
    Hi,

    In theory your eth0 should be the GREEN interface and your eth1 should be
the RED interface. Is there a particular reason why you've specified it the
other way round? In order to be a little clearer on your situation where did
you add the sub-interfaces and what exactly did you use to do it (ifconfig,
etc?)

    Rgds,

    Alistair Francis




      -----Original Message-----
      From: Vijay Kumar [mailto:vijay-d+bK1eGgz2KBUy7/[email protected]]
      Sent: 05 November 2004 15:09
      To: Alistair Francis
      Subject: RE: [gpl] iptables configuration help


      Hi,

      Thanks for your email and help.

      This is what I tried :

      a) Added sub interface to external ip of firewall ( eth0:0 )
      b) added iptable rule :
        /sbin/iptables -t nat -A POSTROUTING -p tcp -s 172.16.0.119 -j SNAT
--to-source <external_ip_whih was added above>

      This did not work and hence I tried after adding the INPUT and FORWARD
rules.
      I tried the web site -> http://www.danasoft.com and it still give my
external ip as the original external ip on the firewall. What I need is that
it should see the traffic coming fromm the secondary IP address which I have
added recently.

      Let me know if I am missing out on anything.

      Regards,
      Vijay Kumar.

      On Fri, 2004-11-05 at 18:20, Alistair Francis wrote:
>Hello,
>
>I have added two sub interfaces to the external ethernet interface of
Smoothwall.
>There are 2 machines on the internal LAN and I want them to go out using
the IP of the sub interface,
>i.e access the internet using the exteral IP's.  they should not have any
restrictions by Smoothwall.
>How can do this and what IP Tables rules should I add ?
>
>I have done the following :
>
>iptables -A INPUT -s 172.16.0.119 -d 0.0.0.0/0.0.0.0 -j ACCEPT
>iptables -I FORWARD -s 172.16.0.119 -j ACCEPT
>iptables -t nat -I POSTROUTING -s 172.16.0.119 -o eth1:0 -j
SNAT --to-source <external_ip>
>
>When I addded the rules iptables gave me an error stating :" Weird
character in interface eth0:0, no ! : "
>Where am I going wrong ? Are sub interface allowed in iptables ?
>
>Kindly help.
>
>Vijay Kumar.
_______________________________________________

Hi Vijay,

I may be wrong but it looks to me as if what you are trying to do is
effectively open up two machines to any inbound traffic from the internet.
If I'm right, why would you want to do that? If you just want to have the
two machines go out on different ip's then, I think, all you need is:

	/sbin/iptables -t nat -A POSTROUTING -p tcp -s 172.16.0.119 -j
SNAT --to-source <place_external_ip_here>

at the bottom of your rc.firewall.up

That way the firewall is still protecting the network from inbound traffic
but the specified machines will go out with the specified IP's. Provided
you've set up the additional external IP's already. There is no restriction
on traffic from GREEN going out. I could be wrong :)

Rgds,

Alistair Francis
_______________________________________________
gpl mailing list
[email protected]
http://lists.smoothwall.org/mailman/listinfo/gpl

SmoothWall Stash - Buy Our Stuff! http://cafepress.com/smoothwall