[lkml]   [1997]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: IP-Masq
On Tue, 14 Jan 1997 09:53:39 +0100 (MET), 
Martin Bauer <> wrote:
>The company I am working for is connected to the Internet via a
>Linx-Firewall. This is working pretty well. We use IP-masquerading
>to give people, sitting at PC's with private IP-adresses (172.30.x.x)
>the possibility to 'surf'.
>Now my problem: There are people out there who need to work on several
>specific machines inside our 'safe' Intranet. So this machines have to
>look like they have public IP-adresses to the outside.
>I think the Firewall should act like more than one machine (multiple
>IP-adresses, IP-aliasing?) and then handle the IP-pakets (firewall-rules)
>and send them to the specific host with the private IP-adress inside our

Two basic solutions, but be aware (be very aware) that whatever you do
will reduce the security of your firewall. The internal servers may
end up as effectively unprotected.

1) Give selected internal machines real as well as private IP addresses
and make the firewall "leaky" so packets to those machines can go

A little bit of fiddling on the internal routing with two logical
networks on the same physical cable and selected machines having
more than one IP address but it works. You can even filter which
external machines can get to which internal machines and for which

2) As you suggested, IP aliases on the firewall but then you have to
get the packets from the firewall to the internal machines. You
need userspace plugins to accept the connection on the firewall and
open a second connection from the firewall to the internal servers.

The plugins have to reformat the packets they receive from the
external connection and forward the result over the internal
connection. How easy this is depends on the services you want to
provide. Sensible connections like telnet, pop, nntp are not a
problem, the data does not have to be reformatted, just forwarded.
The protocols that include IP addresses or host names (ftp, http)
are more of a problem, the data packets have to be rewritten before
forwarding, which is why IP masq had so much hassle with ftp.

The TIS FireWall ToolKit (fwtk, has a reasonably
secure set of plugins, although I do not like their new licence
policy. They may work for the services you want to provide, they
may not. There is also a project to develop free firewall
utilities, see

 \ /
  Last update: 2005-03-22 13:38    [W:0.029 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site