[Security Firewall] NAT MNF2 - help please

Hi,

Im trying to use an MNF firewall for reverse masq NAT'ing.

I assume Shorewall can do this but im having no success with the MNF
GUI.

MY setup is this:

Eth0: External ISP link - 167.30.37.60 (Designated as the Internet
interface)
Eth3: Internal LAN link - 203.20.255.1

This will be one of 2 MNF boxes running side by side on separate ISP's

Downstream on our LAN side will be another Firewall router. This router
will default to the 'other' MNF for gateway of last resort. This will be
an interim solution while we phase in BGP.

Currently we have incoming WWW, SMTP and DNS services routed to the
Eth0:167.30.37.60 interface. My problem is if I do not default my
downstream router/firewall to Eth3:203.20.255.1 then replys to WWW, SMTP
and DNS queries will be sent back via the second MNF and ISP.

What I need is for the MNF detailed above to NAT all traffic for certain
incoming IP addresses (ie WWW server IP's, SMTP relay IP and DNS primary
IP). This is effectively the reverse of your normal masq NAT.

What this will achieve is replys to WWW, SMTP and DNS requests via the
Eth3:203.20.255.1 interface rather than the default gateway on the
alternate MNF and ISP.

The solution seems straight forward using the Masq NAT option in the
GUI.

I tried this:


ID: 1
Masq Network: Eth3 (ie all unspecified sources)
Through Interface: Eth0
Optional Network/Hosts: 203.20.255.128/32 (Address for our DNS Primary -
I also have tried 0.0.0.0/0)
SNAT: -- (ie IP address of Eth0 - I also tried 203.20.255.1)


The above settings failed to NAT traffic (pings) to downstream packet
sniffer (ie my test lab)

My conclusion is either MNF2 is failing to write the shorewall rules
correctly or reverse NAT is not possible the way im doing it.

Please help

Sean Dunlop

Network & Security Administrator
Department of Treasury & Finance

200 St Georges Tce
Perth Western Australia 6000
Ph - (618) 9262 1494
Mb - (618) [0]414 488 504
Email - sean.dunlop-s5/[email protected]
Web - www.dtf.wa.gov.au

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________