<br />Hi, <br />I have a LAN that accesses the internet through a single firewall machine which has 2 network cards.<br />I use SNAT to give all of my LAN machines the static external IP of this firewall machine when they venture out.<br />For internet traffic coming in to the firewall i use DNAT to forward it to my webserver on the LAN.<br /><br />So, assuming that:<br /><br /> 1) my LAN has private addresses:<br /> 192.168.0.0/16<br /> 2) my firewall has the external internet-visible address:<br /> x.x.x.x<br /> 3) my firewall has the internal LAN-visible address:<br /> 192.168.0.18<br /> 4) my webserver has my LAN private address:<br /> 192.168.0.11<br /><br />I have an iptables DNAT (destination nat) rule to redirect traffic thus:<br /> tcp x.x.x.x:80 -> 192.168.0.11:80<br /><br />However whilst this is lovely for external clients, it doesn't work for<br />my LAN because:<br /> a) LAN client 192.168.0.Y contacts x.x.x.x via the default<br />route (the firewall).<br /> b) firewall DNATs the connection to LAN webserver destination<br />192.168.1.110 but leaves the source address unchanged as 192.168.0.Y<br /> c) LAN webserver 192.168.0.11 replies direct to LAN client<br />192.168.0.Y because it is on the same network, but LAN client wasn't<br />talking to 192.168.0.11 when it started the connection and therefore<br />ignores these packets.<br /><br />I think I should be able to simply rewrite the source address in (b) to the internal<br />address of my firewall so that all replies from the webserver come<br />back via the firewall and can be correctly de-mangled. In other words<br />all communiction between LAN clients and my webserver will be<br />dog-legged via the firewall.<br /><br />BUT, this doesn't work with my current firehol config.<br />Please please could someone point out where my config is wrong?<br />I have spent hours and hours one this but can't figure it out<br /><br />Thanks in advance<br />#####################CONFIG BELOW######################<br /><br /><br /># The definition of our HOME LAN.<br />HOME_MYIP="192.168.0.18" # The IP on our HOME LAN<br />HOME_MYIF="eth1" # The HOME LAN interface<br />HOME_BCAST="192.168.1.255" # The HOME LAN broadcast<br />HOME_LAN="192.168.1.0/255.255.255.0" # The HOME LAN<br />HOME_SERVICES="all"<br /><br />HOME_DHCP=0 # Set to 0 to disable<br /><br /><br /># --- PUBLIC ---<br /><br /># The definition of our PUBLIC interface.<br />PUBLIC_MYIP="x.x.x.x" # Leave empty for dynamic IP<br />PUBLIC_MYIF="eth0" # The public interface<br />PUBLIC_SERVICES="ssh http https"<br /><br /># Is the PPP interface a DIAL-ON-DEMAND?<br />DIAL_ON_DEMAND=0 # Set to 0 to disable<br /><br /><br /># --- TRUSTED ---<br /><br /># Hosts in the internet I trust for accessing private services<br /># Empty these to disable.<br />TRUSTED_IPS=""<br />TRUSTED_SERVICES=""<br /><br /><br /><br /># --- BLACKLIST ---<br /><br /># A space-separated list of IPs to be blocked.<br />blacklist=""<br /><br /><br /># ----------------------------------------------------------------------------<br /># HELPERS<br /># ----------------------------------------------------------------------------<br /><br /># Block all traffic from/to certain IPs<br />if [ ! -z "${blacklist}" ]<br />then<br /> blacklist full "${blacklist}"<br />fi<br /><br /><br /><br /># ----------------------------------------------------------------------------<br /># NETWORK ADDRESS TRANSLATION<br /># ----------------------------------------------------------------------------<br /># Change the source/destination of packets...<br /><br /># Should we do SNAT or MASQUERADE?<br /># If there is a PUBLIC_MYIP defined, we should do SNAT, otherwise MASQ.<br />#<br />if [ ! -z "${PUBLIC_MYIP}" ]<br />then<br /><br /> snat to "${PUBLIC_MYIP}" \<br /> outface "${PUBLIC_MYIF}" \<br /> src "${HOME_LAN}" dst not "${UNROUTABLE_IPS}"<br /><br /> snat to "${HOME_MYIP}" \<br /> outface "${HOME_MYIF}" \<br /> src "${HOME_LAN}" dst "${PUBLIC_MYIP}"<br /><br />else<br /> masquerade "${PUBLIC_MYIF}"<br />fi<br /><br /><br /># To have some public service hit an internal machine, do this:<br /><br />dnat to 192.168.0.11:80 \<br /> inface "${PUBLIC_MYIF}" \<br /> src not "${HOME_LAN} ${UNROUTABLE_IPS}" \<br /> proto tcp dport 80<br /> <br /><br /><br /># ----------------------------------------------------------------------------<br /># PROTECT SELF<br /># ----------------------------------------------------------------------------<br /># Protect the firewall host...<br /><br /># --- HOME ---<br /><br /># Protect us from the HOME LAN<br />interface "${HOME_MYIF}" home src "${HOME_LAN}" dst "${HOME_MYIP} ${HOME_BCAST}"<br /> policy reject<br /> <br /> server "${HOME_SERVICES}" accept<br /> <br /> client all accept<br /><br /> <br /># DHCP needs 0.0.0.0/255.255.255.255 access.<br />if [ ${HOME_DHCP} -eq 1 ]<br />then<br /> interface "${HOME_MYIF}" dhcp<br /> server dhcp accept<br />fi<br /><br /><br /># --- PUBLIC ---<br /><br /># Protect us from the PUBLIC<br />interface "${PUBLIC_MYIF}" internet \<br /> src not "${UNROUTABLE_IPS}" \<br /> `test ! -z "${PUBLIC_MYIP}" && echo "dst '${PUBLIC_MYIP}'"`<br /> <br /> protection strong<br /> policy drop<br /> <br /> # Are there any trusted PCs/services?<br /> if [ ! -z "${TRUSTED_PCS}" -a ! -z "${TRUSTED_SERVICES}" ]<br /> then<br /> server "${TRUSTED_SERVICES}" accept src "${TRUSTED_PCS}"<br /> fi<br /> <br /> server "${PUBLIC_SERVICES}" accept<br /> <br /> client all accept<br /><br /># DIAL-ON-DEMAND needs this in case there is a PUBLIC_MYIP defined.<br />if [ ${DIAL_ON_DEMAND} -eq 1 ]<br />then<br /> interface "${PUBLIC_MYIF}" dialup<br /> client all accept<br />fi<br /><br /><br /># ----------------------------------------------------------------------------<br /># PROTECT ROUTING<br /># ----------------------------------------------------------------------------<br /># Protect the LAN...<br /><br /># Route traffic for the clients on the LAN<br />router internet2lan inface "${PUBLIC_MYIF}" outface "${HOME_MYIF}" \<br /> src not "${UNROUTABLE_IPS}" dst "${HOME_LAN}"<br /> <br /> # route all client traffic<br /> client all accept<br /> <br /> # For the dnat example above, this is needed:<br /> server http accept dst 192.168.0.11<br /><br /> <BR>