Problems configuring gateway/firewall with static IP addresses

[Matthew Singerman]

Ed Greshko wrote:
> Matt Singerman wrote:
>
>   
>> The gateway will be replacing an existing one which is beginning to show
>> its age.  It has static IP addresses for both the LAN and WAN, and the
>> machines behind it (servers) have publically-addressable static IP
>> addresses (not 10.x.x.x, 192.168.x.x, etc.).  This is important, obviously.
>>
>> I have found numerous guides online for setting up a gateway and
>> firewall using DHCP and NAT to use private IP ranges for machines on the
>> LAN, but this is obviously not what I want to do.  I cannot find any
>> information about setting it up using all static IP addresses.  I would
>> assume that this would be if anything simpler to configure, but I am
>> havind a devil of a time.
>>
>> Our local subnet is the entire 141.161.111.0/24 block
>> (141.161.111.0-141.161.111.255).  I have a working router on
>> 141.161.111.241, and the subnet mask being used by all machines here is
>> 255.255.255.0
>>
>> Basically, I have eth0 configured to be the WAN connection, and it is
>> working fine.  I can ping machines off the network, and machines can
>> ping it.  Where I am running into problems is with IP forwarding
>> actually allowing connections through.
>>
>> Here is eth0's config file:
>>
>> DEVICE=eth0
>> ONBOOT=yes
>> BOOTPROTO=static
>> IPADDR=141.161.111.243
>> GATEWAY=141.161.111.241
>> NETMASK=255.255.255.0
>> NETWORK=141.161.111.0
>>
>> eth1 is configured to be the LAN interface.  It has the following settings:
>>
>> DEVICE=eth1
>> BOOTPROTO=static
>> BROADCAST=141.161.111.255
>> HWADDR=00:0E:2E:79:F6:17
>> IPADDR=141.161.111.242
>> GATEWAY=141.161.111.242
>> NETMASK=255.255.255.0
>> NETWORK=141.161.111.0
>> ONBOOT=yes
>>
>> I have modified /etc/sysctl.conf so that net.ipv4.ip_forward is set to 1.
>>
>> Other than that...  I am at a loss as to what to do.  Can anyone point
>> me in the direction as to what my next step should be?
>>     
>
> The IP address of ethO is 141.161.111.243 and the IP address of eth1 is
> 141.161.111.242.  They are both on the same subnet.  So, what are you
> trying to do?
>
>   
Hi Ed,

They are, yes - this should be possible, right?  I am trying to firewall 
off part of our network from the rest of the network and the outside 
world.  We have several servers with public IP addresses that are static 
(they are servers).  I would like for this Linux server to sit between 
their outside connection to the world and the switch that all the 
servers are plugged into, and act as a gateway and a firewall.