Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have 5 static IP addresses from our ISP:

XXX.XXX.XXX.180
XXX.XXX.XXX.181
XXX.XXX.XXX.182
XXX.XXX.XXX.183
XXX.XXX.XXX.184

On our firewall box, the NIC that is connected to our cable modem, appears to have all 5 IP addresses set on it. A previous IT guy set this thing up, and I'm not sure exactly what he did. Are these virtual interfaces on this NIC or what? Here is my ip addr output for that NIC:

rwd0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
    inet XXX.XXX.XXX.180/24 brd XXX.XXX.XXX.186 scope global rwd0
    inet XXX.XXX.XXX.181/29 brd XXX.XXX.XXX.186 scope global rwd0:FWB9
    inet XXX.XXX.XXX.182/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB10
    inet XXX.XXX.XXX.183/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB11
    inet XXX.XXX.XXX.184/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB12
    inet6 fe80::250:8bff:fe61:5734/64 scope link 
       valid_lft forever preferred_lft forever

I'm a bit new to firewalls and networking so I'm just trying to figure out what he had going on here. I know he used Firewall Builder to configure the iptables rules, maybe that has something to do with the "FWB" I see in those names?

So my questions are:

  1. What is going on here? Virtual Interfaces? Or something else?

  2. If we want to put in a second firewall in parallel with this firewall but we only want it to handle traffic to XXX.XXX.XXX.182, how do we get rid of the static XXX.XXX.XXX.182 address on this existing firewall box?

The firewall is running on Fedora 11 (yes I know, not the best choice, hence the reason I'm looking into replacing the firewall and also an example of the reason the previous IT guy no longer works here).

share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

probably not the best answer, but generic one - you can always do:

cd /etc
grep -R  XXX\.XXX\.XXX\.182 .

this will give you ide in which file in /etc [ where usually - in sane setups - this sort of information lives ] this ip shows up - this will be good place to start your investigations.

share|improve this answer
add comment

Fedora has it's own network configuration in /etc/sysconfig/network-scripts. Files with IP configuration are named ifcfg-'name_of_interface', for your setup probably ifcfg-rwd0, ifcfg-rwd0:FWB9, etc..

If you want to have another router parallel to this one, removing ifcfg-rwd0:x should be sufficant. And you need to add these IPs to the second router/fw, ofcourse.

share|improve this answer
add comment

Yes they are virtual interfaces, the normal naming scheme is ethX:Y. X being the main interface and Y being a subinterface identifier. Usually you will see eth0:0, eth0:1, etc.

In this case it looks like your main interface is called rwd0 and the rwd0:FWB[9-12] are subinterfaces.

Your guess of them being setup by firewall builder is very reasonable.

As far as why this was done, you need to alias all of your public IPs on the firewall that you want to offer services on for machines behind the firewall. Say you had 2 webservers and you wanted to host them both on standard 80. If you only had one ip, say your .180, you couldn't do it, you'd could only send port 80 to one machine behind the firewall. With multiple addresses you can say traffic targeted at .180:80 goes to webserver1 while .181:80 goes to webserver2.

Haven't personally dealt with Fedora or Firewall Builder so I can't tell you the specific location for the file to edit, but some usual suspects are: /etc/sysconfig /etc/conf.d /etc/network

Basically, look around in etc and you will find it.

share|improve this answer
    
Actually it is technically possible to have two web servers behind one IP address using a reverse proxy. That doesn't work for all services though. –  Matt May 10 '10 at 21:29
    
The point was you can only send the traffic from the firewall to one place per ip/port combo, yes that place could be a device that then determines which webserver to send it to, but unless you need that for load balancing, I bet getting an extra IP address is going to be way cheaper. Webserver was just an example, could be mail, ftp, ssh, etc. –  ManiacZX May 10 '10 at 23:43
add comment

Well it looks like they are secondary IPs:

[kbrandt@kbrandt: ~/scrap/] sudo ifconfig eth0:0 192.168.12.12 netmask 255.255.255.0
[kbrandt@kbrandt: ~/scrap/] ip addr show eth0   
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:19:d1:03:39:a5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.254.15/24 brd 192.168.254.255 scope global eth0
    inet 192.168.12.12/24 brd 192.168.12.255 scope global eth0:0
    inet6 fe80::219:d1ff:fe03:39a5/64 scope link 
       valid_lft forever preferred_lft forever

However, I can't say why the previous admin assigned them to the firewall itself, I also don't know what a rwd device is I'm afraid.

To remove it would be something like:

 sudo ip addr del 192.168.12.12 dev eth0

For my case, but like I said I don't recognize the rwd device, so proceed with caution.

Edit:
Oh, RaLink wireless interface is rwd? in this case just replace my eth0 example with rwd0.

Edit 2:
This actually just to show Maniac what I am talking about:
Machine 1:

$ sudo iptables -t nat -L -b 
Chain PREROUTING (policy ACCEPT 14 packets, 1431 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  554 46536 DNAT       all  --  any    any     anywhere             12.12.12.12         to:192.168.1.15 

Chain POSTROUTING (policy ACCEPT 823 packets, 72596 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    3   600 SNAT       all  --  any    any     192.168.1.15         anywhere            to:12.12.12.12 

Chain OUTPUT (policy ACCEPT 823 packets, 72944 bytes)
 pkts bytes target     prot opt in     out     source               destination

$ifconfig
eth0      Link encap:Ethernet  HWaddr 00:21:9b:1d:4c:7d  
          inet addr:192.168.1.154  Bcast:192.168.1.255  Mask:255.255.255.0

eth0:0    Link encap:Ethernet  HWaddr 00:21:9b:1d:4c:7d  
          inet addr:192.168.1.15  Bcast:192.168.1.255  Mask:255.255.255.0

Machine 2:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
12.12.12.12     192.168.1.154   255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0

$ ping 12.12.12.12
PING 12.12.12.12 (12.12.12.12) 56(84) bytes of data.
64 bytes from 12.12.12.12: icmp_seq=1 ttl=64 time=0.604 ms
64 bytes from 12.12.12.12: icmp_seq=2 ttl=64 time=0.629 ms

And then tcp dump confirms the pings go where I think they go...

share|improve this answer
1  
You assign them to the firewall so you can expose services behind the firewall targeted at those addresses. Also if you want to make different groups of machines going outbound use different IPs (say, your users get .180 and your mail server gets .181 to lower the chance of your mail server IP getting blacklisted from malware activities). –  ManiacZX May 10 '10 at 20:56
    
I don't see why you would need to do that, as long as the packets get there and you have the SNAT and DNAT you should be good. So for instance if you public IP is 12.12.12.12. As long as the hop away from you have route 11.11.11.0/24 gw 12.12.12.12 you should be able to NAT to and from 11.11.11.0 even if it isn't assigned. I could be wrong, I have never tested this in production with Linux, but that is how I do my Ciscos. And this setup using virtual interfaces seems to work fine on my desktop. –  Kyle Brandt May 10 '10 at 21:46
    
We use SmoothWall and the IPs are aliased on the firewall's red interface when we have multiple public IPs. I don't see how it would work without. How would the ISPs router know to send the traffic to the firewall otherwise. Like you said, firewall public 12.12.12.12, that means it's gateway is say 12.12.12.1 and you have a second IP of 12.12.12.13 you want the firewall to port forward to a server inside. If the firewall isn't running 12.12.12.13 as an alias, how does 12.12.12.1 know to talk to the firewall for that traffic? –  ManiacZX May 10 '10 at 23:51
    
ManiacZX: The neighbor router knows because it has an entry in the routing table like I described. For example 12.12.12.0/24 via 12.12.12.1. It then knows to to send any packets destined to 12.12.12.13 will be sent to the interface with the IP of 12.12.12.1. –  Kyle Brandt May 11 '10 at 0:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.