Charles Steinkuehler wrote: > Scott wrote: > >> Hi, >> >> I'm using bering and shorewall (penultimate releases). I have >> three interfaces on my device: eth0 eth1 eth2. eth0 is the public >> interface to which my ISP has directed a /29 subnet. eth1 and eth2 >> are two non-routable subnets (192.168.1.0/24 and 192.168.2.0/24), >> respectively. I'm stuggling to find a way to host both 1.2.3.4 >> and 1.2.3.5 on eth0, and to direct .4 traffic to eth1 and .5 >> traffic to eth2. I think I know what to configure in shorewall, >> but I'm not sure where to configure the second address for eth0 in >> /etc/network/interfaces (if at all). Please enlighten me. >> >> # cat /etc/network/interfaces: auto lo iface lo inet loopback auto >> eth0 iface eth0 inet static address 1.2.3.4 masklen 29 broadcast >> 1.2.3.7 gateway 1.2.3.3 auto eth1 iface eth1 inet static address >> 192.168.1.1 masklen 24 broadcast 192.168.1.255 auto eth2 iface eth2 >> inet static address 192.168.2.1 masklen 24 broadcast 192.168.2.255 >> > > > I'm not sure about the shorewall specifics of implementing this, but > I'd probably use static NAT to accomplish this. If you NAT the > public IP's to IP's on different subnets, normal routing will take > care of getting the traffic to the proper interface. It looks like > shorewall is setup to handle static nat "out of the box": > > http://www.shorewall.net/Documentation.htm#NAT > http://www.shorewall.net/NAT.htm > > Another solution would be to use proxy-arp across more than two > interfaces, but that would require both internal networks to have the > same IP numbering, which doesn't sound like what you're wanting, and > would create a lot of confusion if you have more than the basic > server systems attached. If, however, you are essentially only > hooking up the public servers on each network, and are using two > networks to keep them isolated from each other, a proxy-arp solution > would be worth considering. >
I don't think static nat would work because my eth1 interface has more VNC servers on it than eth0 has routable IPs.
This is starting to look like my vlan project from last year, but in
reverse. Is it conceivable to use the vlan module to set up eth0.1 and eth0.2 with 1.2.3.4 and 1.2.3.5, respectively, for configuration in shorewall? I'd rather not go this route as I suspect there is a simpler solution.
-Scott
-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
