Date: Tue, 09 Aug 2011 15:15:01 +0200 From: Marek Salwerowicz <marek_sal@wp.pl> To: Chuck Swiger <cswiger@mac.com> Cc: freebsd-net@freebsd.org Subject: Re: ipfw - accessing DMZ from LAN Message-ID: <4E4132D5.8020700@wp.pl> In-Reply-To: <A7D49BE7-7822-49BB-91B9-B8EDF09090CA@mac.com> References: <4E412093.8000105@wp.pl> <A7D49BE7-7822-49BB-91B9-B8EDF09090CA@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
W dniu 2011-08-09 15:09, Chuck Swiger pisze:
> On Aug 9, 2011, at 4:57 AM, Marek Salwerowicz wrote:
>> Right now everything works from the Internet - if I do ssh to xx.yy.zz.170, I really can connect to host 192.168.0.10 etc.
>>
>> The problem is that when I want to connect from my 10.0.0.0/24 network (and even from router) to any DMZ host, using it's public address (any of xx.yy.zz.{170,172,173} ), I can't connect and in fact I am connecting to the router.. So I am unable to access my web, mta, ftp servers that are located in DMZ
> It's not working because you configured natd to work against traffic flowing via vr3, but traffic from your LAN is coming via vr0. While you can change natd to run against all traffic, it's much better to avoid re-writing purely internal traffic by setting up a DNS view for your machines in the DMZ which uses internal IPs rather than the public IPs.
So should I allow trafic from LAN to DMZ and setup my local DNS to
connect to hosts in DMZ using private IPs ?
>
> Or, if you insist upon your DMZ hosts being on externally routable IPs, then go ahead and configure them with externally routable IPs rather than using natd's redirect_address, and only do NAT for internal traffic via vr0 instead.
>
>
Am I able to configure them with externally IPs only and having eg.
bandwidth control using only one router?
My current setup is that I have separately router, web server and mail
server but If I want to limit bandwidth, I have to do it on proper
machine instead of configuring only one device.
Regards,
--
Marek Salwerowicz
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4E4132D5.8020700>