On Sat, 8 Jan 2005, Bill Jonas wrote:
> On Sat, Jan 08, 2005 at 10:57:23AM -0700, George Toft wrote:
>> Qwest allows me 4 IP addresses, and I would like to take advantage of
>> them so we can have more than one computer at the site at one time.
>
> Do you have more than four computers internally? If not, just NAT them.
> As a reminder, NAT is many-to-many; masquerading (a Linux-specific term,
> or if it's not now, Linux was the first to use it) is just a special
> case.
In George's case that will not work. As I understand his problem, the
source external/public address of the HTTP connection needs to be
difference for each internal machine.
You could do this with some super-nasty IPTables rules, but that would
likely be pretty painful.
You may also be able to make it easier by bringing up four internal
gateways (eth1, eth1:0, eth1:1, and eth1:2) and four external addresses on
the firewall (eth0, eth0:0, eth0:1, and eth0:2), and give each LAN host
its own internal gateway (they will all still be in the same subnet, so
they will be able to talk to eachother just fine). Then on the firewall,
the IPTables rules could be simplified to just redirecting packets coming
in from eth1 to go out eth0, in from eth1:0 to go out eth0:0, in from
eth1:1 to go out eth0:1, etc...
Still not very clean, but do-able.
Here is another idea, and I am not quite sure if this would work off-hand
(still too early in the morning for me), but it would be really easy to
try it out. Bring up your four external addresses on the firewall, then
add four identical routes (but with different interfaces) to your ISP's
gateway router. For example (if your netblock is 1.2.3.0/24 and your ISP's
gateway router is 1.2.3.1):
# route add default gw 1.2.3.1 eth0
# route add default gw 1.2.3.1 eth0:0
# route add default gw 1.2.3.1 eth0:1
# route add default gw 1.2.3.1 eth0:2
That may cause the firewall box to pseudo-randomly pick an interface to
the gateway for different packets. Of course, this would be a total hack,
but much easier to test out than the "real" way of doing it using
IPTables. Of note, if your firewall is doing reverse path filtering, you
may need to disable that for this to work, since the routes may well now
be asymetrical.
--
~Jay
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)