On Jun 10, 2009, at 6:47 AM, Steve Loughran wrote:
> Hi all
>
> Long time user of FWBuilder (very happy with it on Linux and the win32
> client), but I have an odd question.
>
> On a gateway host, with multiple exit NICs, Is it possible to NAT the
> source IP to reflect which NIC it existed from (depending on system
> routing)?
>
> e.g. if I have eth0 and eth1 both having exits to the internet, can I
> automatically Src NAT to the IP of eth0 if it leaves via that NIC, and
> the same for eth1?
>
> I dont want to hard code this info a policy, nor do I want to NAT buy
> the destination, I just want to it to say "if it leaves via eth0, src
> NAT to eth0 IP".
>
> Is this even possible, or should I just retire to a darkened room
> for an
> hour or two? :)
>
> Many thanks in advance for you help, it is greatly appreciated.
you need two NAT rules, one with interface object eth0 in Translated
Source and another with interface eth1 in Translated Source.
I finished rewriting two documents for the Firewall Builder Cookbook
just yesterday, "Examples of Source Address Translation NAT Rules" and
"Examples of Destination Address Translation NAT Rules". The first has
an example that shows how using interface object in Translated Source
adds "-o eth0" to the generated SNAT command. Extrapolate this example
to two interfaces and you get your configuration.
http://www.fwbuilder.org/guides/firewall_builder_snat_rules.html
http://www.fwbuilder.org/guides/firewall_builder_cookbook.html
Vadim Kurland ✍
vadim@...
|