Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The answer to my question maybe is not that hard but anyways, I do not know what to do.

So, I just got in a new job in a Univerisity and I found out that the network (the LAN) is full of public IP addresses. Seriously, the whole LAN (probably more than 150 hosts) has it' own internet IP address and I don't know how to manage it.

I have a very good experience using iptables (Linux firewall) in a NAT'ed environment. But then how should I proceed in an environment where all my LAN is working with a bunch of public IP addresses? Should I just use the "forward" rules and ignore the NAT rules or is there any other issue in such environment which I should take care?

Can I add a firewall between the router and the LAN in order to produce packet filtering for these public IP addresses in my LAN or will this just not work?

Thanks!

share|improve this question
4  
Just because they're using public ip addresses internally doesn't mean that NAT is not happening. –  EEAA Jun 2 '12 at 19:00
4  
A firewall doesn't need NAT to be a firewall. –  Shane Madden Jun 2 '12 at 19:09

1 Answer 1

up vote 1 down vote accepted

It's alot easier without NAT. If you have experience with iptables, it should be simple: (i've used 1.2.3.0/24 as your LAN). Just use the FORWARD table.

  • allow ESTABLISHED and RELATED connections (exactly same as with nat)
  • allow outgoing ports 80,433,... where source address is from the local IP range (if you need to filter outgoing traffic) (-s 1.2.3.0/24 allows from source addresses from your LAN, and if you dont set the destionaton "-d", it means any destination). If you don't restrict outgoing traffic, just use "-s 1.2.3.0/24 -j ACCEPT")
  • allow needed services (if you have a webserver, allow port 80 with destination ip of your webserver) (-d 1.2.3.4 -p tcp --dport 80, ... if you dont set the source -s, it means any source ip)

  • drop everything else

for example:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 1.2.3.0/24 -j ACCEPT #allow everything out
iptables -A FORWARD -d 1.2.3.4 -p tcp --dport 80 -j ACCEPT #webserver
iptables -A FORWARD -d 1.2.3.0/24 -j DROP
share|improve this answer
    
Nice! Thanks Mulaz, unfortunately I cannot test your solution RIGHT NOW, but I should do it this week. –  sparc86 Jun 2 '12 at 21:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.