Many external IP-adresses

[teukka]

Hi

First have to say, sorry that I'm writing in english..... hope somebody answers to me

How can I have (can I have) many external IP-adresses in my IPCop firewall?

The page http://www.ipcop.org/1.4.0/en/admin/html/section-firewall.html#section-port-forwarding
says "Ports ranges cannot overlap each other." and "You cannot forward the same port to several machines."

This is strange because in my opinion many commercial firewall's can have many external IP's and
route things like I need (okay I'm nerd with no money).

The situation is like that I need to get firewall/nat that can route/handle following:

- 2 separate www-servers, lets say geek1 and geek2
- geek1 has internal IP 192.168.0.10 and external IP 123.123.123.1
- geek2 has internal IP 192.168.0.11 and external IP 123.123.123.2

So the final question is, does IPCop understund ipaliasing at all in external interface?
and if it does how can i use it?

Regards,

Pekka
Finland

[MI6Fred]

IPCop only handles one external connexion, that means one IP adress. You can access one, two or three different local networks (green, orange and blue interfaces) from IPCop but it only handles one Internet link.

The port forwarding documentation refers to the way every NAT capable firewall works : you can only forward one port to one local IP adress.

How do you plan de receive packets for both IPs on your IPCop box ? Do you have two external connexions ?

Such advanced routing rules are not supported in IPCop as far as I know, at least not in their web interface. If you have only one external connexion (only one interface is connected to the Internet), you may be able to manually set these rules.

[teukka]

IPCop only handles one external connexion, that means one IP adress. You can access one, two or three different local networks (green, orange and blue interfaces) from IPCop but it only handles one Internet link.

The port forwarding documentation refers to the way every NAT capable firewall works : you can only forward one port to one local IP adress.

How do you plan de receive packets for both IPs on your IPCop box ? Do you have two external connexions ?

I have one physical external interface (with one IP-address) on IPCop machine but just about 15min ago I make some IP-aliases from command line for it so now the interface has three public adresses like this:

Code: Tout sélectionner

eth0    Link encap:Ethernet  HWaddr 00:XX:XX:XX:XX:XX
          inet addr:123.123.123.1  Bcast:123.123.123.255  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:596251 errors:0 dropped:0 overruns:0 frame:0
          TX packets:702833 errors:0 dropped:0 overruns:0 carrier:0
          collisions:15135 txqueuelen:1000
          RX bytes:88581153 (84.4 MiB)  TX bytes:595212210 (567.6 MiB)
          Interrupt:52 Base address:0x8400

eth0:0 Link encap:Ethernet  HWaddr 00:XX:XX:XX:XX:XX
          inet addr:123.123.123.2  Bcast:62.255.255.255  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:52 Base address:0x8400

eth0:1 Link encap:Ethernet  HWaddr 00:XX:XX:XX:XX:XX
          inet addr:123.123.123.3  Bcast:62.255.255.255  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:52 Base address:0x8400

So Now when I have many addresses on same card normally I can use them all to connect that machine. But I still can't get IPcop (or that machine) understund that it really has many external IP-adresses and could use them... I can make ssh-server listen only address 123.123.123.1 and port 22
or adresses 123.123.123.1 and 123.123.123.2 but not 123.123.123.3 so why can't I make things that I describe earlier.. I'm confused

[Franck78]

~false

IPCop can handles many IP aliases on it's RED interface. Of course RED can't be standart adsl with DHCP. Your provider must assign you some fixed IP.

There is some pending problems with aliases and NAT.
Maybe GUI don't let you do port transfert of this style:

IPaliases1:portX=>svr1
IPaliases2:portX=>svr2

if portX is the same. This is due to NAT (if not possible). Just try or read portfw.cgi!

[teukka]

~false

IPCop can handles many IP aliases on it's RED interface. Of course RED can't be standart adsl with DHCP. Your provider must assign you some fixed IP.

There is some pending problems with aliases and NAT.
Maybe GUI don't let you do port transfert of this style:

IPaliases1:portX=>svr1
IPaliases2:portX=>svr2

if portX is the same. This is due to NAT (if not possible). Just try or read portfw.cgi!

Thanks! no my situation is not completly poor \o/ I'll just read and try then anh hope

thanks again

Pekka

[MI6Fred]

In my opinion, the web interface would need quite some changes to be able to handle such rules ... you should write them yourself, in rc.firewall.local.

[phaby]

je suis desolé mais je vais repondre en français

on peut effectivement attribuer plusieurs adresses IP à l'interface RED et faire des transferts de ports sur ces differentes adresse IP.

There is some pending problems with aliases and NAT.
Maybe GUI don't let you do port transfert of this style:

IPaliases1:portX=>svr1
IPaliases2:portX=>svr2

if portX is the same. This is due to NAT (if not possible). Just try or read portfw.cgi!

Voici un extrait de mes transferts de ports (realises par l'interface graphique):

TCP a.b.c.37 :
80(HTTP) => 192.168.150.247 : 80(HTTP) Serveur Audio HTTP

TCP a.b.c.39 :
80(HTTP) => 192.168.150.249 : 80(HTTP) Server Web

J'ai donc des transferts sur le meme ports (sur des alias differents et des @IP des destinations differentes) et cela marche, pourrais-tu donner plus de precisions sur ces problemes ??

[Franck78]

Un peu longuet à lire, c'est le premier topic:
https://sourceforge.net/mailarchive/mes ... id=9540949

Mais il y en a eu d'autres des topics. Sur Ixus aussi d'ailleurs.
Pour résumer très rapidement, on ne peut pas assigner une IP-alias qui seraient exclusivement réservée à un serveur en GREEN/ORANGE.
En effet, certains aimeraient bien qu'un serveur connu sur internet par son IP alias utilise toujours cette IP-alias dans ses échanges. Mais le masquerade assigne toujours l'IP-RED...
Le dernier problème/exemple en date était un serveur SMTP.

Voila

[phaby]

exact, je comprends mieux...

j'ai eu ce probleme, un prestataire nous envoyait des requetes sur une @IP-alias mais ce n'est pas celle-ci qui leur repondait (mais bien l'@IP DEFAULT ), on a cherchait un p'tit moment pourquoi ça marchait pas !!