I am trying to set up a system to do NAT and other iptables-stuff (like logging, firewall, monitoring, etc.). The ISP provides a dynamic IP address and the DSL modem does NAT.
I have the following "small-business" configuration:
192.168.1.1 |-----------|
----------------------| |
| SWITCH 1 |
192.168.1.2 | |
----------------------| |
| |
192.168.1.3 | |
----------------------| |
|-----------|
|
| 192.168.1.4
|
|--------------|
| Dual NIC |
| IPTABLES m/c | NAT
|--------------|
|
|
|192.168.2.2
|
|--------------| 192.168.2.1 |----------------|
| SWITCH 2 | ------------|DSL Modem NAT |
|--------------| |----------------|
My goals are to control what each node on 192.168.1.x LAN can do, log entries, etc. The IPTABLES machine will be doing a lot more than what the Iptables CLI can... Some C interface to the libnetfilter_queue library is expected as we need to do some custom monitoring and logging.
I do not have a static Public IP address. So, I need to depend on the NAT built in the DSL. Effectively I will end up with two NATs in series. One SNAT through IPTables with source changed to 192.168.2.2. The second is the one that the DSL modem will do to change source IP from 192.168.2.2 to whatever is the public Internet IP assigned at the time.
I think that there must be a better approach. What is it? Or am I totally offtrack?