Firewall for more than one static IP address DSL (was Re: Dual port dual subnet question)
From: Ben (bluesky6_at_ix.netcom.com)
Date: 09/14/04
- Next message: Ben: "Re: Top-posting angers the USENET gods [was: Dual port dual subnet question]"
- Previous message: Noozer: "Re: Top-posting angers the USENET gods [was: Dual port dual subnet question]"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Tue, 14 Sep 2004 09:58:52 -0700
Well, I found the solution to what I wanted to do and as usual, the
solution was simpler than the original problem :-)
I just got 2 static IP addresses from my DSL provider and I wanted to
hook up two physically distinct webservers.
I had originally thought of connecting the DSL modem to a hub then
have 2 connections from the hub to the firewall machine. Each ethernet
port from the hub would have one IP address.
After looking at the ifconfig manpages, I found that I could use the
"alias" option in the hostname.if file (hostname.xl0 in my case):
inet 155.155.155.34 255.255.255.0 NONE
inet alias 155.155.155.45 255.255.255.0 NONE
Effectively, this configured the single Ethernet port xl0 with 2 IP
addresses. So I didn't need the hub...
The next thing I had to do was to figure out how to redirect port 80
requests from each of these 2 IP addresses (from the single xl0 port)
to the correct server.
Normally, you would include the following line to /etc/pf.conf to
redirect port 80 requests to your webserver:
rdr on $ext_if inet proto tcp to port 80 -> 192.168.1.55 port 80
where $ext_if is the external interface e.g. xl0 in my case
This line specifies that all port 80 requests from the external
interface would be redirected to the webserver.
What I needed to do was to add the additional IP address parameter.
Fortunately, pf allowed me to do that:
rdr on $ext_if inet proto tcp to 155.155.155.34 port 80 ->
192.168.1.55 port 80
This specifies that port 80 requests to the 155.155.155.34 IP address
that arrive on the external port will be routed to the webserver on
192.168.1.55 on the internal subnet.
To add routing for the second server, I added the following:
rdr on $ext_if inet proto tcp to 155.155.155.45 port 80 ->
192.168.1.57 port 80
And voila!
I've also included this info in my long-dormant OpenBSD for Dummies
webpage at www.svgeek.com/dummies/opendummies.html
Please email me if you find typos or factual errors.
Thanks.
Ben
- Next message: Ben: "Re: Top-posting angers the USENET gods [was: Dual port dual subnet question]"
- Previous message: Noozer: "Re: Top-posting angers the USENET gods [was: Dual port dual subnet question]"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
