Nat with no firewall

Faxanadu · 2010-12-29 05:32:17

Greetings

I want setup an archlinux router that only does Nat (bec I have only one ip), and let all the computers full exposed to internet, I am completely aware of the security risks, I want all machines be in a DMZ (demilitarized zone), so if someone could make an ipchain list for that, or tell me about a program.

Thanks for any help.

P.D.
Yes, I am aware of the security risks, and no, I don't want forward ports, what I want is a real DMZ network.

Last edited by Faxanadu (2010-12-29 05:35:05)

fukawi2 · 2010-12-29 10:34:29

If you only have 1 public address, then you can't have a "real" DMZ. You could DNAT all traffic from the internet to one machine though.

You can use this script to set it up. Change the variables to suit your situation.

#!/bin/bash
NET='ppp0'
DMZ_PC='192.168.1.100'
iptables -t nat -o $NET -j MASQUERADE
iptables -t nat -i $NET -j DNAT --to $DMZ_PC

Faxanadu · 2010-12-30 06:05:16

Only one computer?, well man thank you.

fukawi2 · 2010-12-30 09:49:04

With only 1 public IP Address, you're pretty limited.

You can forward different ports to different internal servers, such as:

#!/bin/bash
NET='ppp0'
SSH_PC='192.168.1.100'
FTP_PC='192.168.1.150'
WWW_PC='192.168.1.200'
iptables -t nat -o $NET -j MASQUERADE
iptables -t nat -i $NET -p tcp --dport ssh -j DNAT --to $SSH_PC
iptables -t nat -i $NET -p tcp --dport ftp -j DNAT --to $FTP_PC
iptables -t nat -i $NET -p tcp --dport http -j DNAT --to $WWW_PC

But each port can still only go to 1 computer. If you want to have access to SSH on 2 computers, then you'll have to use 2 different ports (eg, 22 and 2222)

Most ISP's will give you and additional /29 address range (6 usable addresses), but they will almost always charge you for it, and require you to be on a business plan (not a home plan). With an additional /29, you can setup a "real" DMZ.

Arch Linux

#1 2010-12-29 05:32:17

Nat with no firewall

#2 2010-12-29 10:34:29

Re: Nat with no firewall

#3 2010-12-30 06:05:16

Re: Nat with no firewall

#4 2010-12-30 09:49:04

Re: Nat with no firewall

Board footer