This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Need help configuring services in DMZ

Hi everyone,

I'm using Astaro 4.015.  My ISP gave me an official network (/27) with 29 useable IPs.  I want to be able to use all of these IPs in my DMZ.  I've read the FAQs and it mentions using a transfer network  in order to do this.  I need to know the following once I get this transfer network configured:

1.  How do I make the official IPs accessible from the Internet?  Let's say I want  to assign an official IP to my websites or other services hosted in my DMZ, do I  bind an alias IP to the external interface for each official IP I want to use?

2.  Will binding the alias IP to the external interface automatically make it accessible from the internet?  Do I still need to create a DNAT entry for this?

3.  Do I need to configure any packet rules for the official IPs used in the DMZ?

4.  How do I ping these offical IPs that are used as websites (or other services) in my DMZ?  I just want to make sure I can access the service from the internet.  I understand this may not be neccessary.

Any help on this would be greatly appreciated.  Thanks in advance for any and all assistance I get on this.

Thanks.

=Jeffrey=

This thread was automatically locked due to age.

0 SecApp over 21 years ago

Inquisitive, aren't you?

1.Yes

2. No; you need to make a DNAT covering the range of addresses.

3. Yes; the firewall is deny by default between all interfaces, for reasons of security.

4. On the Menu under packetfilter rules, you will find an ICMP section. Turn the settings on for testing, then shut them off when things are proven... [hit the question mark in the upper right corner for context-sensitive help; help may flake under IE6 -see my other recent post]
Cancel
Vote Up 0 Vote Down

Cancel
0 cyclops over 21 years ago

jeffmc,

[ QUOTE ]
gave me an official network (/29) with 29 useable IPs

[/ QUOTE ]
Don't want to be picky but a /29 subnet gives you 6 useable IP addresses.

Greetings
cyclops
Cancel
Vote Up 0 Vote Down

Cancel
0 jeffmc over 21 years ago in reply to SecApp

[ QUOTE ]
Inquisitive, aren't you?

1.Yes

2. No; you need to make a DNAT covering the range of addresses.

3. Yes; the firewall is deny by default between all interfaces, for reasons of security.

4. On the Menu under packetfilter rules, you will find an ICMP section. Turn the settings on for testing, then shut them off when things are proven... [hit the question mark in the upper right corner for context-sensitive help; help may flake under IE6 -see my other recent post]

[/ QUOTE ]

Thanks SecApp!!!

Now all I need to do is convince my ISP that I need this transfer net. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 jeffmc over 21 years ago in reply to cyclops

[ QUOTE ]
jeffmc,

[ QUOTE ]
gave me an official network (/29) with 29 useable IPs

[/ QUOTE ]
Don't want to be picky but a /29 subnet gives you 6 useable IP addresses.

Greetings
cyclops

[/ QUOTE ]

Thanks cyclops, you're right it's a /27.  I just had 29 stuck in my head.  [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 firebear_01 over 21 years ago in reply to jeffmc

Hi,
if you put your 29 official IP's as additional Addresses on your external ASL-interface and make DNAT rules to forward the traffic to computers in your DMZ then your DMZ-computers only needs private-IP's like 192.168.0.0/24 . For what do you mean you need a transfernet ?

firebear
Cancel
Vote Up 0 Vote Down

Cancel
0 jeffmc over 21 years ago in reply to firebear_01
[ QUOTE ]
Hi,
if you put your 29 official IP's as additional Addresses on your external ASL-interface and make DNAT rules to forward the traffic to computers in your DMZ then your DMZ-computers only needs private-IP's like 192.168.0.0/24 . For what do you mean you need a transfernet ?

firebear

[/ QUOTE ]

Well according to the Astaro 2.x FAQ (#4008) I needed a transfer net because my ISP provided me with a router which is in front of my Astaro box like the diagram below:

Code:

      -------------      ---------       /----
      |ISPs Router|      |       |      /
      |           |------|  ASL  |-----/  LAN
      |           |      |       |     \
      -------------      ---------      \
                             |           \----
                             |
                            / \
                           /   \
                          /     \
                         /  DMZ  \
                         |       |

The FAQ goes on to say:

      Problem: You want your official IPs to be available in the DMZ (3),
               but they are on the connection between the Router and the
               ASL (1).

      Solution 1: Set up a transfer network between the router and the
                  ASL. You will have to talk to your ISP about that. He
                  needs to give you a transfer network (netmask .252)
                  to use and he must add a route to the router to send
                  your original official network to the ASL box.

      Solution 2: Use Proxy ARP to forward a part of your official
                  network to the other firewall side. This does not
                  require the help of your ISP, but it is ugly and should
                  only be used if Solution 1 is not possible for some
                  reason.

Are you telling me that with Astaro 4.0x this is no longer necessary and what you stated above is all I need to do to retain all of my IPs and not having to split them into different subnets?

If you or anyone else can verify this I'll be a happy camper!

Thanks in advance for your assistance.

=Jeffrey=
Cancel
Vote Up 0 Vote Down

Cancel
0 jeffmc over 21 years ago in reply to jeffmc

bump

Please someone read this thread and let me know if it is still necessary in Astaro 4.0 to get a transfer network from my ISP so I can use all of my official IPs in my DMZ rather than having to split it and use Proxy ARP.

I really need to know so I can get this finalized once and for all.

Thanks in advance for your assistance!
Cancel
Vote Up 0 Vote Down

Cancel
0 Andy_01 over 21 years ago in reply to jeffmc

ASL V4 is still a routering device and not a bridge, you will need a transfer network if you don't want to do subnetting.
Cancel
Vote Up 0 Vote Down

Cancel
0 firebear_01 over 21 years ago in reply to Andy_01

Hi,
shure asl is a routing-device but if you put your official addresses on the external-interface as additional-adresses and make a dnat-rule to forward the incomming traffic to the networkdevices in the DMZ wich have private-ip's there is no need for routing the official-adresses because your isp-router does that for you.
If you do it like this there is no need for a transfer-net between your isp and your asl-box, isn't it ??
But who can answer this finally ?????????

firebear
Cancel
Vote Up 0 Vote Down

Cancel
0 AJo over 21 years ago in reply to firebear_01

[ QUOTE ]
But who can answer this finally ?????????

[/ QUOTE ]
The answer is quite obvious and lies in the basic principles of computer communication, routing and NAT [:)]

And yes you are right - unless you really need to use the fully qualified inet address on the inside.

Another way to solve the bridging functionality I believe was discussed in the hacking thread.
same adress range @ external/internal interface
Cancel
Vote Up 0 Vote Down

Cancel