Network / Firewall issue ?????????

[Netizen]

Network / Firewall issue


So far I had KVMs and CTs with public IPs assigned to them however this is now not possible due to the limit of amount of IPs I can have per server from the DC I am in.

I have therefore decided to start having KVMs with private IPs using NAT redirects of the main server IP to the various internal KVM guest.
When however I decided to put a firewall on those KVMs (software fw) I realised that I cannot have rules matching specific remote hosts because all the traffic is visible as coming from the hardware node main IP and not the remote IP.
I therefore cannot create rules with remote IPs to block or to allow as I only see my main IP.

What is the method to overcome/solve this? (Expect hardware firewall please, this is not an option).

 

[hossam_2009_2008]

i hope we can get a reply!

 

[spirit]

i hope we can get a reply!

Well, I think it's normal because you are doing nat ....

Do you have tried in routed mode or bridge mode ?

 

[Netizen]

Well, I think it's normal because you are doing nat ....

Do you have tried in routed mode or bridge mode ?

Wrong answer.
Think of the NAT you operate (usually) on a home router. You PCs on the LAN still see the remote (foreign) IPs as sending traffic. Not the gateway itself (the home router).

 

[spirit]

Wrong answer.
Think of the NAT you operate (usually) on a home router. You PCs on the LAN still see the remote (foreign) IPs as sending traffic. Not the gateway itself (the home router).

can you send your iptables rules ?

 

[Netizen]

Not handy right now but I will.

 

[kobuki]

If you're doing dnat on specific ports or port ranges to help fully utilise your available public subnet, then the remote host address doesn't change. I'm curious about the rules too. On a side note, if you want your specific virtual hosts to be seen from different public ip addresses, you should use snat to achieve that (outbound connections). I'm doing the same on several hosts because it makes networking a lot more flexible and easier to secure (that is, even if I have enough public IPs, I still use NAT).