Des Wass wrote:
> OK, here goes again.
>
> external interface is 203.x.x.10
> Internal address to masquerade is 192.168.1.0/24
>
> with:
> ipchains -A forward -s 192.168.1.0/24 -d 0/0 -j MASQ
>
> every address behind gets masked as 230.x.x.10. Which is ok. Now I have
> one machine that needs to be 203.x.x.43 (have C class).
>
> How can i get one to be 203.x.x.43 while the others remain standard masks
> behind 203.x.x.10?
I suspect you can't do it. What you might be able to do is allow incoming
socket connections to ports on the internal box to the 203.x.x.43 address,
by setting up that address and using port forwarding.
eg:
First configure 203.x.x.43 as a valid external interface for your box (eg:
use the dummy driver, or the eth0:0 alias device. If you use the dummy
driver then don't forget to use "arp -s".
Then, set up port forwarding rules like this:
ipmasqadm portfw -p tcp -L 203.x.x.43 www -R 192.168.1.XXX www
this means that connections on port 80 destined to 203.x.x.43 will go
to port 80 on 192.168.1.XXX instead.
You need to do this once for every TCP and UDP port that you want to
forward. There is no "catch-all" rule.
For outgoing packets, you have no choice. They will all be masqueraded
to come from 203.x.x.10 not 203.x.x.43. This *will* change in kernel
2.4 as well as 2.3.x as there are now arbitrary source/dest/port packet
re-write rules that you could use.
If you want a generic solution right now and have an unlimited amount
of cash to spend, then there are only two products that I know of that
do this effectively: Cisco IOS and Checkpoint Firewall-1.
----+------------------------+--------------------------
Del | mailto:[EMAIL PROTECTED] | Christchurch, New Zealand
----+------------------------+--------------------------
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
