3

My previous DSL modem had a function called "DMZ Host" (which in other platforms seems to be named Default Host). When you select a computer in your network to be the DMZ Host, it forwards every non-manually forwarded port to that computer as well as assign via DHCP the modem's external IP to that computer (dmz host).

So, effectively, it is duplicating the external IP and giving it to the internal computer. For a variety of reasons, this was handy, particularly for picky programs (random ports) or gaming.

But now that I've changed to optic fiber, the modem does not have that functionality. I am planning to create a Linux-box for routing purposes. Is there any way to recreate the same functionality with iptables?

Hints involving other platforms/software are very welcome.

I'm attaching a diagram for better clarity (an edit of the picture from this question: Accessing the DNAT'ted webserver from inside the LAN ) in here:

DMZ Host diagram

Thanks a lot in advance! I've been trying to find information about setting this up but I've been unable to. Maybe i'm using the wrong search terms.

Community
  • 1
Joe M.
  • 31
  • 2
  • I may add, I've come across before this solution with iptables: http://www.linuxquestions.org/questions/linux-networking-3/iptables-dmz-host-490491/ which solves the problem of forwarding all ports automatically. However, I cannot think of a way to handle the duplicate IPs in the system, since this solution is mapping the external IP to a different, internal, private IP address. – Joe M. Dec 18 '15 at 15:32
  • Perhaps a better way to express this question would be: How to do routing with duplicate IP addresses in two different interfaces? – Joe M. Dec 18 '15 at 15:46
  • Draytek seems to call this functionality "True-IP DMZ" or "True-DMZ" http://www.draytek.com/index.php?option=com_k2&view=item&id=1256&Itemid=293&lang=en https://www.draytek.co.uk/archive/kb_vigor_truedmz.html – Joe M. Dec 18 '15 at 15:53

1 Answers1

-1

The solution is the external link you already provided. You have to setup DNAT in your iptables and forward specific ports/port range to the internal address of the server. In the routers, it works the same way, its NOT duplicating the external IP address!

Mihaly Vukovics
  • 24
  • 3
  • Thanks a lot Mihaly! But, would it work even when you are having duplicate ip addresses in two interfaces? – Joe M. Dec 18 '15 at 15:36
  • Basicly, you are able to set up the same IP adress for your server as the external IP address of the modem, but then your linux box (router) will not be able to decide which way to route the traffic. (will have same ip adresses in two directions). The iptables will also try to NAT from the same dest IP to the same dest IP. – Mihaly Vukovics Dec 18 '15 at 15:38
  • 1
    Ah! I see. Indeed, I don't know how the router used to deal with it, but it DID assign the same external IP address for the server. Which is sort of what i'm trying to figure it out. Though it doesn't make sense from the networking point of view. Anyway, thank s a lot! – Joe M. Dec 18 '15 at 15:40