Solved

IPCop forward external to external red

Posted on 2011-09-28
6
412 Views
Last Modified: 2012-05-12
Hi Experts,

What we are trying to do is route or forward traffic that comes to our external ip (x.x.x.x) to another external ip (y.y.y.y).

We know how to forward from external to internal but we are looking to go red to red.

Any Ideas

Cheers
Nik
0
Comment
Question by:nikdonovanau
  • 3
  • 3
6 Comments
 
LVL 10

Expert Comment

by:pfrancois
Comment Utility
With the default settings of IPCop, this is not possible, because IPCop is cutting traffic from red to red..

Possible workarounds:

1. let the modem/router do that, upstream, or
2. add an iptable rule in your /etc/rc.d/rc.firewall.local file allowing traffic from x.x.x.x to y.y.y.y, or
3. forward the traffic to some host inside your LAN or DMZ that is going to re-forward that traffic to y.y.y.y

Good luck.
0
 
LVL 10

Accepted Solution

by:
pfrancois earned 500 total points
Comment Utility
I advice you workaround #2. You will have to add the rules after the line containing "start)".
0
 
LVL 1

Author Closing Comment

by:nikdonovanau
Comment Utility
Thanks for the advise. Much appreciated.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 1

Author Comment

by:nikdonovanau
Comment Utility
For anyone out there trying to do this.  This is how I achieved it.

After start) in /etc/rc.d/rc.firewall.local

/sbin/iptables -t nat -A CUSTOMPREROUTING -p tcp -i wan-1 --dport [port] -j DNAT --to-destination [dest_ip]:[dest_port]

/sbin/iptables -A CUSTOMFORWARD -p tcp -i wan-1 -d [dest_ip] --dport [dest_port] -j ACCEPT

Thanks a lot.
0
 
LVL 10

Expert Comment

by:pfrancois
Comment Utility
Thank you for this very useful complement of information. Instead of option "-i wan-1", I would say "-i $RED_DEV", right?
0
 
LVL 1

Author Comment

by:nikdonovanau
Comment Utility
Sure I think you can use the variables from the config file.

My config file seemed to have $RED_DEV_1 or somthing like that so I chose to just hard code the name of my wan ethernet interface.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now