hey, here's what i'm trying to do...i've searched the docs and this board and most people have one external ip and then dnat to multiple internal hosts on different ports for different services. but i've got a /27 block of external ips that i need to assign to 20 some odd internal hosts, all of them running multiple services. i need asl to answer for all external ips and then route the traffic to an internal host. how exactly do i set that up? here's what i've tried so far (i'm using 1.824). i've added virtual hosts on the firewall for the external ips so the firewall will answer. (ip addr add x.x.x.x/27 broadcast x.x.x.159 label eth1:1 dev eth1). so now the firewall answers for the external ip i want. ok, then i've set up my definitions for the external ip and the corresponding internal host. then i set my packet filter to allow traffic to that external ip. now here's where i'm getting stuck. how do you tell the firewall to send that traffic to the internal host when it answers for the external ip address? i hope it's not dnat because i'll have about 1000 dnat rules for every service on every internal host (like i said, they are all running multiple services). i've also tried adding dnat for one host, but that doesn't work anyway (i've tried dnat from the firewall ip to internal host and the virtual ip to internal host, no luck). do i have to add static routes from the external ip to the internal ip on the firewall? can i do that from the webmin page, or from the console? in my mind, i see this as adding the virtual host so the firewall will answer arp requests for the external ip, then add rules to allow traffic to that internal host, and then add a static route from the external ip to the internal ip. this is how i've been doing it with checkpoint (i know this isn't checkpoint, but the thought process should be similar). thanks, bob. lastly, here's my config: astaro 1.824, two nics, one external and one internal. the external is plugged into a cisco router and the internal is plugged into a cisco switch. thanks again, bob.
This thread was automatically locked due to age.
