> think i shoud sent you a draw from the Network aswell, to make things > more clear.. > > NET serial 0 > | > | > CISO Router from the ISP > | with IP 10.0.0.5 netmask : 255.255.255.252 > | > | > | eth0 10.0.0.6 > LRP-CD with Script V1.1 - eth1 192.168.1.0 for normal LAN netmask : > 255.255.255.0 > | eth2 192.168.0.0 DMZ netmask : 255.255.255.0 > > 1. static-nat 10.0.0.6 213.33.113.25
This much makes sense... > 2. static-nat for DMZ 192.168.0.2 213.33.113.26 > and so till 213.33.113.30 This I don't understand...your ISP has assigned you a /30 network, with one usable IP. This happens to be a private IP (10.0.0.5), but you're saying they static-NAT a public IP to the private IP. This is fine, and it prevents loosing 3 public IP's just to provide you with a single usable IP. I do not, however, understand where the additional IP's are coming from (213.33.113.26). These will have to come from your ISP, but you don't have enough exernal IP's for them to be on the external network. Your ISP also can't route the IP's directly to you, as they are not a complete subnet. The only way any of this makes any sense is if your ISP is routing an ADDITIONAL private IP network to your upstream interface (perhaps something like 10.0.1.0/27), and is performing a static NAT on some of THOSE IP's. If this is the case, just setup your LRP with a conventional DMZ, clear the rules that block sending/recieving packets from the 10.0.0.0/8 private IP space, and you should be all set. Your ISP will deal with translating your private IP's to the appropriate public IP's. > static-route: 0.0.0.0 0.0.0.0 serial 0 > 192.168.0.0 0.0.0.0 10.0.0.6 > > so i believe now, that i have use the same rules in somewhy for eth0, > which are used for the DMZ at ipfilter.conf so that i can use the FW > itself for the normal things aka ssh and so on. > > so which DMZ rules at the ipfilter is should really now update, so that > i can use them aswell for eth0. I'm not clear on exactly what you're asking, but there are seperate mechanisms for allowing traffic to the external inferface and allowing traffic to a DMZ. For instance, to allow external ssh connections to the firewall, put the following in /etc/network.conf: EXTERN_TCP_PORTS="0/0_ssh" Charles Steinkuehler http://lrp.steinkuehler.net http://c0wz.steinkuehler.net (lrp.c0wz.com mirror) _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
