Another IP forwarding Problem

[prairieseahorse]

Hi all. Here's my situation.

I'm setting up a firewall with RedHat 7.1. I have 3 network cards installed and working.

eth0 address 64.1.1.1/27 points to internet
eth1 address 64.1.1.27/27 points to DMZ network
eth2 address 10.0.0.76/8 points to internal network

route table says: (my internet gateway is 64.1.1.30

Destination GW Mask Iface
64.1.1.30 * 255.255.255.255 eth0
64.1.1.0 * 255.255.255.224 eth1
10.0.0.0 * 255.0.0.0 eth2
127.0.0.0 * 255.0.0.0 lo
default 64.1.1.30 0.0.0.0 eth0

ipchains is set to masquerade anything from the 10. network and everything else is set to ACCEPT (for now).

What happens is:
Can ping each interface from inside the firewall and from 10. network and DMZ network, so I know the interfaces are alive.

Can see the internet from the 10. network, so I know IP forwarding is working.

BUT DMZ can't see outside the firewall. I suspect that I'm confusing it by splitting a subnet across the two interfaces, but was hoping I could get away with specifying specific hosts to the one interface and letting the others follow a lower level route.

Any comments or suggestions would be appreciated.

 

[Guest_imported]

Hello,

I have the same problem, but intwo card and SuSE 7.1 Version.

I think the problems is.. find a server that allow connect the service TCP wuth other user connected to Server.

If you have a solutions please send me to

casistel@cantv.net

 

[marsd]

This config is not workable.
You should use private ip addresses for your dmz
machines and if you need access to services in the dmz
use rinetd or a generic proxy of some kind.
Think about dynamic routing. Routed or zebra.
(Use ripv2 or ospf.)
Static routing with three interfaces can be messy
even without masquerading.

Thats my two cents.
Good Luck.

 

[prairieseahorse]

Thanks Marsd

You confirmed my suspicions about the attempt. Unfortunately rinetd won't work in my case. The DMZ contains multilple web and FTP servers. I think I'll probably break the external IP block into two subnets. I can put one subnet in the DMZ (providing some protection) and leave one subnet exposed.

Thanks again for your advice.