🚀 go-pugleaf

Dans sa prose, alex (ntnewsNOSPAM@hrz3.hrz.tu-darmstadt.de) nous ecrivait :
> i get from my isp 16 addresses this can only be done by a subnet
> 255.255.255.240 (210.2.5.16-31) - i think so!? if i am wrong - please
> correct me... and please tell my why (newbie :-((( ). this is the situation
> i'm in - and i need to workaround - how ever!

16 address is not much I agree, and it would be too bad to waste them in
massive subnetting...

> can i change the subnetmask without telling this my isp? realy i haven't

Yeah sure ! As long as your subnets does not use addresses that haven't been
given to you, you can.

> anytime worked with calculating ip subnets... and haven't deep tcpip
> knowledge :-((( one of my greatest problems...

Check Freshmeat for ip subnet calculators.
Just a tip : you need N addresses in your subnet, mask is 255.255.255.(256-N).
N must be 2^x (I do not know how to say that in english :/).
You need 4 : 255.255.255.252
You nedd 16 : 255.255.255.240
You need 30 : not possible, 30 <> 2^x. Must use 32 = 2^5 : 255.255.255.224
See what I am trying to mean ?

> am i right and will this be working if i will change this to
> eth0 = 210.2.5.17 / 255.255.255.252 - (210.2.5.16-19)

OK.

> eth1 = 210.2.5.20 / 255.255.255.248 - (210.2.5.16-23)

Not OK. As you can see, this subnet is covering the other one before. Use
255.255.255.252 mask to have 210.2.5.20-23.

> eth2 = 210.2.5.24 / 255.255.255.248 - (210.2.5.24-31)

OK, and all is fine.

> hm... looks wrong... eth0 and eth1 having overlapping ip's... in eth0 .19 is
> broadcast adress and in eth1 the .23 - this looks like only 2 hosts in
> dmz... shit...

As I said, it is fine, but, for a given subnet, you must have one network
address and one broadcast address, which means you have lost 6 addresses in
the subnetting process (210.2.5.16,19,20,23,24,31).

Another approach is to use NAT in such a way :

210.2.5.16/28 --eth0-- Box --eth1-- DMZ1, RFC1918 : 192.168.1.0/24
			|
			|__eth2____ DMZ2, RFC1918 : 192.168.2.0/24

So, you established full NAT rules, one public IP to one private IP, on
the DMZ you need. I don't have your needs anymore in mind, but, if you
want to have 210.2.5.21 on DMZ1, you can use a rule like this one :

iptables -t nat -A PREROUTING -i eth0 -d 210.2.5.21 -j DNAT --to 192.168.1.21

For one on DMZ2 :

iptables -t nat -A PREROUTING -i eth0 -d 210.2.5.27 -j DNAT --to 192.168.2.27

And if your server needs to initiate connections to the real world :

iptables -t nat -A POSTROUING -o eth0 -s 192.168.2.27 -j SNAT --to 210.2.5.27


Such a way, you can keep your whole subnet in front, and redirect IPs where
you want your servers to stand.

-- 
BOFH excuse #34:

(l)user error