I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
sean
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
Hi Sean,
I can give you the manual method for ipv4.
For traffic to cross between the two interfaces forwarding must be enabled. That is done in sysctl.conf
net.ipv4.ip_forward=1
Then the default route is assigned to the router interface:
ip route add default via <gateway_ip> dev <router_interface>
Very straight forward.
HTH
On Fri, Jan 24, 2020 at 7:19 PM Mike Wright nobody@nospam.hostisimo.com wrote:
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
I can give you the manual method for ipv4.
For traffic to cross between the two interfaces forwarding must be enabled. That is done in sysctl.conf
net.ipv4.ip_forward=1
Then the default route is assigned to the router interface:
ip route add default via <gateway_ip> dev <router_interface>
It's better to enable forwarding for the NIC that needs it
/proc/sys/net/ipv4/conf/<NIC>/forwarding /proc/sys/net/ipv6/conf/<NIC>/forwarding
so
net.ipv4.conf.<NIC>.forwarding = 1 net.ipv6.conf.<NIC>.forwarding = 1
On 1/24/20 12:41 PM, Tom H wrote:
On Fri, Jan 24, 2020 at 7:19 PM Mike Wright nobody@nospam.hostisimo.com wrote:
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
I can give you the manual method for ipv4.
For traffic to cross between the two interfaces forwarding must be enabled. That is done in sysctl.conf
net.ipv4.ip_forward=1
Then the default route is assigned to the router interface:
ip route add default via <gateway_ip> dev <router_interface>
It's better to enable forwarding for the NIC that needs it
/proc/sys/net/ipv4/conf/<NIC>/forwarding /proc/sys/net/ipv6/conf/<NIC>/forwarding
so
net.ipv4.conf.<NIC>.forwarding = 1 net.ipv6.conf.<NIC>.forwarding = 1
Nice pointer, Tom. It's very interesting.
I'm curious to see what would happen if, given the OP's setup, the inside facing nic had forwarding enabled but the router side nic did not. Would that create a sort of network diode where NEW traffic within the host was only allowed to flow in one direction but RELATED and ESTABLISHED traffic could always return freely unless specifically blocked by firewall rules.
A lot of ramifications there.
Thanks, Mike Wright
On 1/24/20 1:06 PM, Mike Wright wrote:
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
Hi Sean,
I can give you the manual method for ipv4.
For traffic to cross between the two interfaces forwarding must be enabled. That is done in sysctl.conf
net.ipv4.ip_forward=1
Then the default route is assigned to the router interface:
ip route add default via <gateway_ip> dev <router_interface>
Very straight forward.
HTH _______________________________________________
But how do I make it persistent ?
sean
On 1/25/20 9:39 AM, sean darcy wrote:
On 1/24/20 1:06 PM, Mike Wright wrote:
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
Hi Sean,
I can give you the manual method for ipv4.
For traffic to cross between the two interfaces forwarding must be enabled. That is done in sysctl.conf
net.ipv4.ip_forward=1
Then the default route is assigned to the router interface:
ip route add default via <gateway_ip> dev <router_interface>
Very straight forward.
HTH _______________________________________________
But how do I make it persistent ?
The forwarding setting is sysctl.conf is persistent.
Here is a link that shows how to add settings using nmcli. These settings should be persistent (can't swear to it. I kill networkmanager with extreme prejudice :)
https://www.server-world.info/en/note?os=Fedora_29&p=initial_conf&f=...
On 1/24/20 9:54 AM, sean darcy wrote:
I'm trying to set up a dmz between my internal network and the router. Interface A for internal, interface B for the router. How do I make sure the default route is set to interface B ?
Whichever interface has a default gateway configured will be the default route.
-
Mike Wright -
Samuel Sieb -
sean darcy -
Tom H