View Single Post
  #7   (View Single Post)  
Old 8th May 2010
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 4,131
Default

You assign all three public IP's to the external interface. During install you only assign 89.248.88.18 with the 244 netmask your ISP has given you. After the install has finished you can assign the other two addresses as aliases to the same interface. (aliases need a /255 netmask) Don't worry about these aliases until you installed everything

For your local net you have to use another network, here I suggest the 10.0.0.0/24 network, one of the nets reserved for private networks.

Because the firewall/packet filter will do NAT (network address translation) your hosts in the 10.0.0.0/24 network will be able to connect and communicate with hosts on the internet.
Code:
      I N T E R N E T
             |
             |
             |
             |
       ------------
       89.248.88.17
       ------|-----
             |
             |
             |
             |
-------------|---------------
       89.248.88.18/240
       89.248.88.19/255
       89.248.88.20/255
     external interface

     FREEBSD   FIREWALL

     internal interface
         10.0.0.1/24
-------------|---------------
             |
             |
             |
             |
            LAN
For the FreeBSD firewall, the default gateway is 89.248.88.17. The hosts in the private network 10.0.0.0/24 have to use the internal interface 10.0.0.1 as default gateway.

RE: hostname

The reverse IP lookup of your first IP address fails:
Code:
$ host  89.248.88.18   
Host 18.88.248.89.in-addr.arpa. not found: 3(NXDOMAIN)
So you can use a name of your choice, which does not clash with the official names.

A domain name conists of two names separated with a dot. (yyyyyy.zzzz) As long as the 'zzzz' part, the TLD (Top Level Domain) is different from any official TLD, you are free to choose any name for the 'yyyyy' part.
I use utp.xnet, and names of Greek figures as hostnames.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote