Multi port firewall

Hi there

I already have a firewall/router being used at the entry point to my DSL
home network.

I now need to repeat the process for a small office.

The fun comes with the fact that we will have some internet visible
boxes also located in this office. Best practice would be to have two
firewall boxes one from the WAN (internet) to the DMZ and the other from
the DMZ to the office LAN. However this isn't practical for our needs
(budget / space / power), so we intend to run just the one
firewall/router machine with eth0 to WAN, eth1 to DMZ and eth2 to LAN.
This will also allow me to shape all traffic to and from the internet
(not just to and from My LAN)

eth0 and eth1 will therefore share the same subnet. How do I configure
my firewall/router to route to these boxes correctly?

for example (Fake address)

WAN (88.0.0.1) eth0
DMZ (88.0.0.2) eth1 (Other servers to be internet visible 88.0.0.3 -
88.0.0.15 on this port)
LAN (192.168.1.1) eth2 (NAT)

Yes I could do address translation for all boxes in the DMZ (i.e.
transpose all internet addresses to a local address i.e. 192.168.2.3 -
192.168.2.15) but I really don't want to do this if possible (the
network is likely to become a lot more complicated later and this would
just confuse matters)

Any suggestions?

Andy


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST RemoveThis @lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster RemoveThis @lists.debian.org

Hello,

Andy Simpkins a écrit :
>
> eth0 and eth1 will therefore share the same subnet.

Preferably not if you want to avoid trouble and dirty hacks.

> How do I configure
> my firewall/router to route to these boxes correctly?

If you want the same subnet on two interface, you'd better bridge them
together. You can filter bridged traffic using ebtables or
{ip,ip6,arp}tables through the bridge-nf infrastructure.

WAN--bridge--(routing+NAT)--LAN
|
DMZ


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST.DeleteThis@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster.DeleteThis@lists.debian.org