Dear All,
I want to know MUST the Server machine BEHIND the linux firewall / router machine, then it can be assign ( use ) PRIVATE IP to instead of PUBLIC IP ?
Edward.
Dear All,
I want to know MUST the Server machine BEHIND the linux firewall / router machine, then it can be assign ( use ) PRIVATE IP to instead of PUBLIC IP ? Dear All,
I want to know MUST the Server machine BEHIND the linux firewall / router machine, then it can be assign ( use ) PRIVATE IP to instead of PUBLIC IP ?
I am not sure I understand the question.
If you are asking:
If a machine has to be behind a NATed firewall before you can assign a private IP address. The answer is yes and no. If you want to have several machines to have access to the Internet and only one IP, then you would need to use Network Address Translation. Then you could use one of the private IP address ranges for all of the machines on your internal network while only having a single box directly exposed to the Internet. This is not the same as a true firewall though because it really doesn't HAVE to block any traffic. So the box would really be just a router.
In cases like this, I have found it best to have two NICs in the box that has Internet access. That way, you can use one NIC for external and one NIC for internal traffic.
Here is a simple script that I think would work.
IPTABLES=/sbin/iptables EXTIF="eth0" INTIF="eth1" $IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF -j MASQUERADE $IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT echo "1" > /proc/sys/net/ipv4/ip_forward
aragonx@dcsnow.com wrote:
Dear All,
I want to know MUST the Server machine BEHIND the linux firewall / router machine, then it can be assign ( use ) PRIVATE IP to instead of PUBLIC IP ? Dear All,
I want to know MUST the Server machine BEHIND the linux firewall / router machine, then it can be assign ( use ) PRIVATE IP to instead of PUBLIC IP ?
I am not sure I understand the question.
If you are asking:
If a machine has to be behind a NATed firewall before you can assign a private IP address. The answer is yes and no. If you want to have several machines to have access to the Internet and only one IP, then you would need to use Network Address Translation. Then you could use one of the private IP address ranges for all of the machines on your internal network while only having a single box directly exposed to the Internet. This is not the same as a true firewall though because it really doesn't HAVE to block any traffic. So the box would really be just a router.
In cases like this, I have found it best to have two NICs in the box that has Internet access. That way, you can use one NIC for external and one NIC for internal traffic.
Here is a simple script that I think would work.
IPTABLES=/sbin/iptables EXTIF="eth0" INTIF="eth1" $IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF -j MASQUERADE $IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT echo "1" > /proc/sys/net/ipv4/ip_forward
Hello,
If all of server are NOT DMZ, then they can be assigned ( used ) Private IP ?
Edward.
Hello,
If all of server are NOT DMZ, then they can be assigned ( used ) Private IP ?
Okay, DMZ adds a layer of complexity but really has no bearing on the private IP range.
What is it you are trying to accomplish?
Your DMZ can be behind your NAT box but does not have to be. Some DMZ setups look something like this:
Internet | | | v Border router | | | | | | v v DMZ1 DMZ2 DMZ3 ... | | | v Internal firewall | | | | | | v v Computer1 Computer2 Computer3
So, in this case, you can use either your border router or your internal firewall as your NAT box. Either will do but the border router might be a better choice.
Of course your DMZ boxes should be single tasked. Therefore, each should only have 1 or so ports that are accessible from either your internal network or the Internet. There is much much more to this though. Like, your DMZ boxes should not be allowed to initiate connections, especially to your internal network. There should be no connections coming in to the internal firewall from the Internet or the untrusted network. Etc...
aragonx@dcsnow.com wrote:
Hello,
If all of server are NOT DMZ, then they can be assigned ( used ) Private IP ?
Okay, DMZ adds a layer of complexity but really has no bearing on the private IP range.
What is it you are trying to accomplish?
Your DMZ can be behind your NAT box but does not have to be. Some DMZ setups look something like this:
Internet | | | v Border router | | | | | | v v DMZ1 DMZ2 DMZ3 ... | | | v Internal firewall | | | | | | v v Computer1 Computer2 Computer3
So, in this case, you can use either your border router or your internal firewall as your NAT box. Either will do but the border router might be a better choice.
Of course your DMZ boxes should be single tasked. Therefore, each should only have 1 or so ports that are accessible from either your internal network or the Internet. There is much much more to this though. Like, your DMZ boxes should not be allowed to initiate connections, especially to your internal network. There should be no connections coming in to the internal firewall from the Internet or the untrusted network. Etc...
My means : The Server machine is not DMZ, so can it use Private IP only ?
My means : The Server machine is not DMZ, so can it use Private IP only ?
Your only limitation is that a machine can NOT use an address in the private IP range to communicate DIRECTLY to the Internet.
If you have a router (be it hardware or software) to map your traffic to a public IP, you can use either.
So: If your network has a DMZ, it should have a firewall that protects the internal network. This firewall could (is?) be configured to use NAT (i.e. masquerading). Given all of that, and your server is located on the internal network, it can use either a public or private IP address.
aragonx@dcsnow.com wrote:
My means : The Server machine is not DMZ, so can it use Private IP only ?
Your only limitation is that a machine can NOT use an address in the private IP range to communicate DIRECTLY to the Internet.
Sorry, pardon me !
If you have a router (be it hardware or software) to map your traffic to a public IP, you can use either.
The router machine is a general router machine which provided by ISP, so it can't to be configed with firewall function ( only routed / routing function )...
The router machine is a general router machine which provided by ISP, so it can't to be configed with firewall function ( only routed / routing function )...
If I were you, I'd head over to http://www.shorewall.net/ and check out that site. They have lots of good information on setting up a Linux firewall with diagrams that may shed some light on your given situation.
I would install the shorewall package on FC6 and configure it using the site as your guide. (You should be able to simply do "yum install shorewall") Then if I had additional questions on configuration I'd join the shorewall mailing list and ask on that list as they are friendly and eager to help.
Regards, Ed
aragonx@dcsnow.com wrote:
My means : The Server machine is not DMZ, so can it use Private IP only ?
Your only limitation is that a machine can NOT use an address in the private IP range to communicate DIRECTLY to the Internet.
Sorry, pardon me !
I did not mean to sound like I was yelling. I simply used the capitals to emphasize. :)
If you have a router (be it hardware or software) to map your traffic to a public IP, you can use either.
The router machine is a general router machine which provided by ISP, so it can't to be configed with firewall function ( only routed / routing function )...
Another poster suggested you go and install surewall. I would not suggest you do that! Not without some thought and planning anyway. You would want a good understanding of what that package is and how it can help you. Putting another router that is totally under your control between your network and your ISPs is a good idea though.
Give a lot of thought to your network design and what you want to do with it. Do some reading on DMZs and what they are intended to do. You really want to allow the minimum amount of incoming (and to a slightly lesser degree outgoing) traffic while still allowing your users to perform their functions.
Here are a few sites to get you started:
http://tldp.org/HOWTO/Security-HOWTO/index.html
I hope this all makes sense without being too basic. Security is an important topic.