firewall ??

[Matt Morgan]

On 07/08/2004 02:12 PM, Bobby Knueven wrote:

> Still a little confused on firewalls. Here's my situation (more detail 
> this time).
>
> I am assigned a block of IP addresses from the Office of Information 
> Tech. at our University. Along with this block of IP's come the DNS 
> servers I have to use and the Default Gateway. Everything else, DHCP, 
> File server, webserver is up to me to provide. I need to build a 
> firewall that will allow my current block of addresses(class B), which 
> are assigned to my network from a DHCP server that will is on my 
> network to access the net while providing a secure environment. Since 
> I have a substantial amount of addresses I do not need NAT to use 
> 192's, etc... Where my confusion comes in is the fact that I am 
> already assigned a default gateway on my network. Is it possible to 
> apply a firewall with Internet connection sharing that acts as a new 
> default gateway for my internal network while the firewall would still 
> use the Default Gateway assigned to me? How would I go about sharing 
> that connection without using NAT? Or should I just build a bridging 
> firewall? I am hesitant about a bridging firewall because it seems 
> that it would need to be fairly speedy to keep up with our network 
> traffic. Any recommendations would be appreciated. Thanks.

I realize this is not the answer you're seeking, exactly, but it seems 
that if you just used NAT everything would be a lot simpler. There's 
really almost no reason not to use NAT, if you have a reasonably good 
firewall (and iptables qualifies) and it's kind of easier to understand 
what's going on. And, pretty much everyone runs out of IP addresses 
faster than they expect to--NAT will protect you from that.

With NAT, the internal address of the firewall is the gateway address 
for the internal workstations. So the answer to your question about the 
default gateway is "yes."

So my advice is, just use NAT.

As a side note, when you respond to messages on this list, please post 
your messages at the bottom of the previous message. Although it seems 
strange at first to people who are used to doing it the other way, it 
makes it a lot easier for new people to pick up the discussion in the 
middle. That happens a lot on a list of this volume.

--Matt