Re: Bridge / routing

Wouldn't an IPTables rule on eth1 do all of this? 
Anything with a source IP on the 192.168 address gets SNATted as it exits eth1.
If it doesn't exit eth1, it simply gets routed to the appropriate destination, out eth2.

Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email [email protected]
web www.pacificwireless.com.au

-----Original Message-----
From: Walt Reed [mailto:[email protected]] 
Sent: Thursday, September 07, 2006 1:23 AM
To: [email protected]
Subject: [Ebtables-user] Bridge / routing

Cc: 
Bcc: 
Subject: Bridge + routing?

I have a bridge / firewall that is working perfectly on ubuntu dapper:

/usr/sbin/brctl addbr br0
/usr/sbin/brctl addif br0 eth1
/usr/sbin/brctl addif br0 eth2
/usr/sbin/brctl setfd br0 1
/sbin/ifup br0
/sbin/ifconfig eth1 0.0.0.0
/sbin/ifconfig eth2 0.0.0.0

The interfaces file for br0 looks like:
iface br0 inet static
 address 69.122.123.166
 netmask 255.255.255.128
 network 69.122.123.128
 broadcast 69.122.123.255
 gateway 69.122.123.129

eth2 is connected to a switch and all the "Group A" client machines.
eth1 is connected to a Cisco router with the IP 69.122.123.129.

All the "A" clients get their IP addresses via a DHCP server on the far side
of the router (or the router itself. Not sure - it's a "managed"
router) and the default gateway is set to the router's IP.

It's a situation where there was no firewall at all, so the linux box
as the bridge / firewall protects the clients. All is happy.

Now I need to add a private network on eth3 - 192.168.1.1/24.
eth3 connects to a dedicated switch with a bunch of "Group B" client machines.

I need to NAT "B" clients on the 192.168 net to use a dedicated NAT address
(69.122.123.254) when accessing the internet, but want to ROUTE
bidirectionally to the "A" clients on eth2. This is so eth2
"A" clients (which have real internet addresses) can access printers and
such on "B" (192.168.1.x.)) Likewise, "B" clients (wireless notebooks, etc.)
off eth3 need to access "A" file servers on eth2.

Routing from the 192.168 net seems like it should be easy since the
clients have 192.168.1.1 as the gateway address, but the IP for the
69.122.123.128 net is on br0 and not eth2. I don't want the cisco seeing
the 192.168 addresses at all.

Here is a (bad) ascii diagram...


Group A clients
69.122.123.130-254
   |
   |             +----------------+           69.122.123.129
   |             |                |           +-------+
switch ---- eth2-| Bridge br0     |-eth1 ---- | Cisco | ----- Internet
                 | 69.122.123.166 |           +-------+
                 +-------|--------+
                       eth3
                    192.168.1.1
                         |
                         |
                       Switch
                         |
                         |
                    Group B clients
                    192.168.1.2-254                     


So, how do I do this? It seems I need to:

1) Intercept packets entering eth2 that are destined to 192.168 and
route them out eth3 rather than continuing on to the default gateway of
69.122.123.129...


2) NAT eth3 (192.168) traffic as 69.122.123.254 if the destination is the internet only

Is that all or is there something I'm not thinking of?

I couldn't find any examples that match my situation...

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642