Re: [FW1] Hiding multiple servers behind 1 IP address

[bandit@FW1-NOSPAMzcore.net (Carl E. Mankinen)]

This is REALLY easy to do with FW-1.

All you do is create a STATIC NAT rule with the proper settings.
(actually two rules in NAT tab, and two in the rulebase)


lets say your outside IP is 10.1.1.1 and you have two servers inside
at 192.168.1.1 (ftp) and 192.168.1.2 (http)

On the NAT tab,
orig src = any
orig dest = 10.1.1.1
orig svc = ftp
xlat src = any
xlat dest = 102.168.1.1
xlat svc = original

orig src = any
orig dest = 10.1.1.1
orig svc = http
xlat src = any
xlat dest = 192.168.1.2
xlat svc = original

and then the obvious rulebase entries to allow packets to enter/leave various interfaces.

I recommend NOT using your firewall-1 outside address for anything (except in case of implied rules)
If you are using a single outside IP for everything, then you can't stealth the firewall as easily.

Another problem is what if you want to have 2 ftp servers available from one outside IP?
You could use normal ftp service settings and rules for one, but the other would require you to define
some new service in FW1 and probably end up editing some .def/.C files to make the firewall treat
this as an FTP connection on ports other than 21/20 etc..




----- Original Message ----- 
From: "Really Boring" <rb1005@hotmail.com>
To: <jason@wittys.com>; <toddg@firstlinux.net>
Cc: <fw-1-mailinglist@lists.us.checkpoint.com>
Sent: Thursday, October 05, 2000 3:05 PM
Subject: Re: [FW1] Hiding multiple servers behind 1 IP address


> 
> Not quite - hide NAT only works if the traffic is originating from the 
> "hidden" servers. Todd is trying to have 2 servers share the same IP address 
> for traffic originating from the Internet, not for traffic originating from 
> those 2 servers.
> 
> Check out http://www.phoneboy.com/fw1/faq/0022.html. By the way, I haven't 
> tried it, so if it doesn't work, you're on your own :-)
> 
> -RB
> 
> >From: Jason Witty <jason@wittys.com>
> >To: toddg@firstlinux.net
> >CC: fw-1-mailinglist@lists.us.checkpoint.com
> >Subject: Re: [FW1] Hiding multiple servers behind 1 IP address
> >Date: Thu, 05 Oct 2000 12:28:13 -0500
> >
> >
> >It's called hide-mode NAT in FW-1.  An example NAT rule would look like
> >this (obviously you need an access rule as well):
> >
> >ORIGINAL PACKET NATted PACKET
> >SOURCE DEST SOURCE DEST
> >internal-net ANY hide-addr ORIG
> >
> >Hope this helps.
> >
> >Jason
> >
> >Todd Ginther wrote:
> > >
> > > Hello All,
> > >
> > > I haven't seen a FW-1 solution to something that I currently do with 
> >another firewall product - that is to be able to advertise a single IP out 
> >to the world (firewall external interface) and have the firewall direct 
> >inbound Internet traffic to different internal servers based soley on which 
> >port the firewall gets hit on.
> > >
> > > Example:
> > >
> > >   -Advertised IP address is abc.123.123.1
> > >
> > >   -Traffic hits abc.123.123.1:18000 gets redirected
> > >    to an internal server, machine alpha.
> > >
> > >   -Traffic hits abc.123.123.1:19500 gets redirected
> > >    to a different internal server, machine beta.
> > >
> > > Any ideas?  I would prefer not to have to use up a bunch of IP's to do 
> >one-to-one NAT.
> > >
> > > Thanks in advance, all!
> > >
> > > Regards,
> > >
> > > -Todd
> > >
> > > _____________________________________________________________
> > > Want a new web-based email account ? ---> http://www.firstlinux.net
> > >
> > > 
> >================================================================================
> > >      To unsubscribe from this mailing list, please see the instructions 
> >at
> > >                http://www.checkpoint.com/services/mailing.html
> > > 
> >================================================================================
> >
> >
> >================================================================================
> >      To unsubscribe from this mailing list, please see the instructions at
> >                http://www.checkpoint.com/services/mailing.html
> >================================================================================
> 
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
> 
> Share information about yourself, create your own public profile at 
> http://profiles.msn.com.
> 
> 
> 
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================