PDA

View Full Version : linux firewall for dmz and private nets


blurpee
2005-03-06, 04:39 PM CST
hi all,
looking at 3 different examples (but none that exactly match what i want), i believe i have some of the numbers mixed up here. could anyone help? (sorry it's longwinded)

i have a static ip from my isp (cable modem). i have this connected to a linksys befsx41 router (with 4 port switch built in) w/ addres 192.168.1.1. i'd like to split the network in to two subnets (192.168.1.X (dmz), and 192.168.2.X (personal)). i envision some of the 192.168.1.X subnet to be publicly available www/ftp/etc via port forwarding on the linksys router.

i'd like to create the 192.168.2.X subnet to connect all my personal pcs to. i would like to put a FC3 linux homemake router / gateway / firewall with two nics -one one 192.168.1.2 (connected to the linksys router/switch above) and 192.168.2.1 (connected to the uplink of another switch where other ports are my personal computers). currently on this box, the ethernet lights are all blinking and linux is giving me no errors. it's currently configured to:

eth0 ip: 192.168.2.1 / mask: 255.255.255.0 / dg: 192.168.2.1
eth1 ip: 192.158.1.5/ mask: 255.255.255.0 / dg: 192.168.1.1

i also have to routes defined on that box
destination: 192.168.0.1 / mask: 255.255.255.0 / gw: 192.168.1.5
destination: 192.168.2.0/ mask: 255.255.255.0 / gw: 192.168.2.1

i would like all the 192.168.2.X nodes to be able to see out on the internet via the linksys (192.168.1.1). i would also like the 192.168.1.x to see out on the internet via the linksys (192.168.1.1). however, i do not want to allow the 192.168.2.X and 192.168.1.X to be able to talk (firewall portion). i plan to have 2 dns servers on the 192.168.2.x (internal) and 1 dns server on the 192.168.1.x (external). (for now as i learn all of this)

i have a random 192.168.2.x node set to the a static ip address (such as 192.168.2.4) with mask: 255.255.255.0 and dg: 192.168.2.1.

without any firewall config at this time, i would just like to be able to try and get the 192.168.2.x nodes to see out on the internet (but currently not working). a random node on 192.168.1.x can see out on the internet at this time. could someone please let me know where i've mixed up my network settings (my brain is starting to hurt here a bit)?

many thanks,
jonathan

blurpee
2005-03-07, 05:24 AM CST
i found the errors in my ways...sorry for that ramble...