|
||||||||||
>If I understood former discussions correctly I cannot use filtered >bridge mode because I would never again be >able to connect to my DMZ hosts from my LAN. How am I supposed to set >up something like that ? >For testing purposes I set up something like that and tried to use 1:1 >NAT to reach a DMZ box via ssh. >But it did not work out. Any ideas would be greatly appreciated. No. You can certainly connect to devices on an OPT interface bridged to the WAN. I have a SIP server on OPT1, bridged to WAN. That way my internal clients and my SIP peers can communicate with my SIP server without any form of NAT being involved. I have had this set up for a couple of months without any problems. Just bridge OPT1 with the WAN, and start using your valid external IP addresses on OPT1 (remembering that your default gateway will be m0n0wall's _WAN_ IP address !!!) and don't forget to set 'Enable filtering bridge' and add the appropriate rules as needed. You'll also need to set 'Enable advanced outbound NAT' so that your LAN clients don't get NAT'd on their way to OPT1. Neil, thanks a lot mate, obviously I got confused by this : http://www.m0n0.ch/wall/docbook/examples-filtered-bridge.html 11.3. Configuring a filtered bridge A filtered bridge is a common way of configuring a DMZ segment. This can be used as a typical DMZ where you have hosts on the LAN interface, but is probably more frequently used to protect servers at a colocation facility where there are no LAN hosts. Note Remember you cannot access hosts on a bridged interface from a NAT'ed interface, so if you do have a LAN interface set up, you won't be able to access the hosts on the bridged interface from the LAN. Network Diagram for this Configuration. The following diagram depicts the example configuration described in this section. The colocation facility has assigned you with the subnet 111.111.111.8/29, which includes usable IP's .9-.14. One of those is required for the colo's router, so you end up with 5 usable IP's. I thought the Clients on my LAN Interface are NATed, are they not ? Anyways, just to make that clear once and for all : Router ( 63.64.65.129 ) | | | m0n0 WAN Interface (63.64.65.130) | | +---------- m0n0 DMZ Segment ( OPT Interface ) | ( including hosts 63.64.65.131,132,133... using 63.64.65.130 as gateway in filtered bridge mode ) | | m0n0 LAN Interface ( 171.16.1.1 ) where 171.16.1.1 ist the gateway for all LAN Clients. I always thought in this configuration the LAN Interface is NATed, combined with the m0n0 doc's it gives the impression that this kind of setup will not work. So, Neil, are you really sure about this, or do we need to clear out m0n0's docs ? |