Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 20 Jan 2002 21:15:30 -0500
From:      Allen Landsidel <all@biosys.net>
To:        Nick Rogness <nick@rogness.net>
Cc:        freebsd-questions@FreeBSD.ORG
Subject:   Re: multihomed routing woes..
Message-ID:  <5.1.0.14.0.20020120205959.00a99618@rfnj.org>
In-Reply-To: <Pine.BSF.4.21.0201201251460.50917-100000@cody.jharris.com>
References:  <5.1.0.14.0.20020120013959.00aaaff8@rfnj.org>

next in thread | previous in thread | raw e-mail | index | archive | help
At 12:59 01/20/2002 -0600, Nick Rogness wrote:

>On Sun, 20 Jan 2002, Allen Landsidel wrote:
>
> > [please reply off-list.. not subscribed.]
> >
> > Ok.. for several hours I've been banging my head against the
> > proverbial brick wall, trying to resolve an issue that's been a
> > nuisance for some time.
> >
> > To start from the begining.. my network looks like this :
> >
> > [LAN] <--> [firewall] <--> [router] <--> [internet]
> >
> > The lan side has a public /28 block.
>
>         Why does the lan have a public block?

I have a static IP block from my ISP.. I would also like to have a firewall 
other than the piece of junk in lucent dslpipe "router."

Thus, all the actual boxes get real IPs (for the most part) and I need a 
solution that allows me to put the firewall between the router and the lan.

> > The firewall has one address from that block on the interior
> > interface, and an address in the 10/8 block on the exterior. The
> > router has an address on the 10/8 block on the interior, the ISP
> > assigned address on the WAN interface, and a static route to the
> > firewall 10/8 for my IP block.
> >
> > The problem is simple : All outgoing traffic that *originates* on the
> > firewall attempts to use the 10/8 address.  I'm looking for some easy
> > way to force it to use it's internal address for traffic destined to
> > go out the exterior interface, but so far to no avail.
> >
>
>         The real problem here is that you are running publics on your
>         inside.  Why are you doing this and not using static nat for this?

Why should I use nat if I'm paying for an IP block?  The lan is not an 
intranet, it's a bunch of "real" servers out on the internet.


>         If you have a good reason, then maybe running nat on the router or
>         getting another /30 for your BSD<-->Router would help out.  You
>         could also trip out nat but it would be a mess.

The reason is simply that I'd rather not go through the hassle of assigning 
a bunch of private IPs to my boxes just because they're inside the 
firewall.  What would really be great is an unnumbered interface between 
the firewall and the router, but I don't think either FreeBSD or the cheapy 
lucent dsl router support this option.

Getting the /30 would do, but it seems to me there should be a way to 
handle this "as-is" that isn't a massive hack.


> > My brain can't seem to think of a way to do this via route, and natd +
> > my current stateful IPFW appears to be a no-go.. searching the lists
> > and usenet have turned up others with the same problems, but no real
> > solutions using these tools.  Apparently my only options are:
>
> >    1) ditch the stateful ipfw configuration in favor of a simple
> > 'established' rule (ick)
>
>         That might help while you are debugging.

If I do this, it will work.. period.  I had it this way in the past, but 
thought that I'd rather switch to stateful routing so forged packets 
couldn't blow past the firewall and to the machines within.


> >    2) (maybe?) switch to ipf/ipnat.
>
>         This will gain you nothing...probably make things worse.

I've heard that ipf/ipnat can do exactly what I need.. perhaps I am mistaken.


> >    3) Set up a proxy on one of the internal machines and have the firewall
> > go through that to get out (ick)
>
>         No.

Heh.. but it would work.. I think I didn't explain the problem too 
clearly.. I'll try and explain more clearly here.

The "lan" consists of every machine I have other than the firewall.  Web, 
dns, ftp, cvsup, etc etc servers, all of them in a rack and on a 
switch.  The internal interface for the firewall is also on this segment, 
and has the first IP address in the /28 block.

The external interface of the firewall is the only device plugged into the 
integrated (and slow) hub built into the router.  This serves many purposes 
but the most important two are :
   1) Every packet must pass through the firewall before any others see it, 
via sniffing or any other method.
   2) Any machine surreptitiously plugged into the routers hub will not be 
able to access the internet; I consider this important.

Everything works great *except* for internet access on the firewall 
itself.  Because the default route on the firewall is 10.0.0.1, it always 
attempts to use it's interface on that subnet for internet access.  The 
result, obviously, is that I cannot install ports, packages, or anything 
else directly from the firewall;  I have to download the packages/tarballs 
on another machine and transfer them to the firewall, and then do the install.

I'm only concerned with nating one address, the external firewall 
interface.  natd, however, has about zero capability for this when used on 
a stateful firewall.

I'm coming up with other ideas.. but this seems like it should be easy to 
do, even if it's not.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5.1.0.14.0.20020120205959.00a99618>