First, I have to say that the WebGUI is beautiful, especially
if one contrasts it to say the interface which comes with a
PIX 501 router.
However, I can set up the latter pretty easily for our network
config, but cannot seem to get it right with m0n0wall.
I've searched the FAQ, noting that 13.14 seems to apply to
our situation, but it doesn't make sense to me -- it's a bit
too jargonish for my brain which usually needs concrete examples
when it comes to setting up Firewalls. (I'm not a networking guy.)
I've also searched the list archives, but have not been able to craft
a search which yields any concrete answers.
Hopefully, the following is an adequate description of our
desired firewall/routing set up. (Same as what we had with
the PIX, before it died.)
Our network (using just the HTTP ports to illustrate):
2 HTTP servers: one production, one test
IP addresses: xxx.yyy.zzz.10, xxx.yyy.zzz.20
Available WAN IP addresses: aaa.bbb.ccc.224 - 255
m0n0wall/net4501 eth 1: aaa.bbb.ccc.238
HTTP server 1 (production): aaa.bbb.ccc.239
HTTP server 2 (test): aaa.bbb.ccc.240
aaa.bbb.ccc.239:80 -> xxx.yyy.zzz.10:80
aaa.bbb.ccc.240:80 -> xxx.yyy.zzz.20:80
I have tried the following
Hardware: net4501 w/ 3 eth connectors.
0. m0n0wall static config:
IP addr = aaa.bbb.ccc.238/25
1. Added aaa.bbb.ccc.239 and aaa.bbb.ccc.240 to the Server NAT page.
2. NAT: added the following and applied changes.
WAN TCP ext: aaa.bbb.ccc.239 HTTP int: xxx.yyy.zzz.10 HTTP
WAN TCP ext: aaa.bbb.ccc.240 HTTP int: xxx.yyy.zzz.20 HTTP
3. Rules: added and applied changes.
TCP src: aaa.bbb.ccc.239 HTTP dest: xxx.yyy.zzz.10 HTTP
TCP src: aaa.bbb.ccc.240 HTTP dest: xxx.yyy.zzz.20 HTTP
The above just doesn't work. It seems to be equivalent to
what I would have done to set up the PIX, but obviously it's
not. But if I port scan from a computer on a completely
different network (essentially outside the building)
I get nothing. I'm completely at a loss as to how to
get m0n0wall to do what I bet is pretty simple.
Exactly what steps do I have to perform and in
what order? Please don't use "optional interface"
(as in the FAQ) because nothing's optional to me.
Please make any solution devoid of jargon, such
as "optional interface" and the like. Please
use concrete numbers based on those listed above.