[no subject]

So you have one real IP on the firewall box and virtual IP's that are
directly routed to the real box's private IP.

"iptables -t NAT -I PREROUTING -d <public IP> -j DNAT --to-destination
<private IP>"

There will be no filtering at all on this.

Then add a back route:
"iptables -t nat -I POSTROUTING -s <private IP> -j SNAT --to-source
<public IP>"

It would be good to modify those rules by making a series of tables that
filters out the crap before just routing all the bandwidth to the work
machines.
> 
> If I wanted to place them all on privates I would just ask for one
> public IP from E-Deltacomm. 
> > > --Joe
> > Bob
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
&gt; &gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; 
&gt; _______________________________________________
&gt; Ale mailing list
&gt; Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO &amp; Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
<a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&lt;jkinney at localnetsolutions.com&gt;
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00016" href="msg00016.html">[ale] Firewall design</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00003" href="msg00003.html">[ale] Firewall design</a></strong>
<ul><li><em>From:</em> transam at verysecurelinux.com (Bob Toxen)</li></ul></li>
<li><strong><a name="00011" href="msg00011.html">[ale] Firewall design</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00013.html">[ale] Can anyone help me get the Rox Filer to work with	E	inSUSE9.1</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00015.html">[ale] Can anyone help me get the Rox Filer to work	with	E	inSUSE9.1</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00011.html">[ale] Firewall design</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00016.html">[ale] Firewall design</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00014"><strong>Date</strong></a></li>
<li><a href="threads.html#00014"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>