I'm sorry, I'm rather behind on my mail, as some of you may have
noticed. I hope that I'm not answering problems that have already been
solved, but then again, if you are able to solve your problems without
my help, that's not surprising. :)
Barry Treahy <[EMAIL PROTECTED]> wrote:
>
> My static DSL single class IP is 207.225.204.x/32 on eth0 and the
> internal LAN is 192.168.1.0/24 on eth0:
They can't both be on eth0. Which is it?
> I've tried placing the -W eth0 on each linewith the same results; all
> traffic is blocked.
The -W option means something different on input rules vs. forward
rules. On the input rule, it refers to the interface that the traffic
is coming from. On the forward rules, it refers to the interface to
which traffic is being SENT. So it is important, whether you specify
eth0 or eth1, whichever is your external DSL interface.
> I am making one basic assumption, which may not be safe, but that is
> that all F/W filtering is based on the real IP address and not the
> fake ones since the fake ones are technically not in the accessible
> range...
Well, the filtering rules operate on both sets of IP addresses. For
instance, when traffic is coming in from the external Internet, it is
masqueraded traffic. When it's coming in your local LAN, it's
un-masqueraded. You probably don't have a need to filter internal
traffic, though, so you can concentrate your efforts on filtering
external traffic, and making sure that you don't stop internal traffic.
Using -W ${EXT_IF} should do this, as long as you have either a
default-accept input policy, or a rule to permit traffic on local
interfaces (including the loopback!).
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut
sometimes known as David DeSimone || butter quite like unrequited love."
http://www.dallas.net/~fox/ || -- Charlie Brown
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
