I wish to host a SIP server and DNS at the end of an ADSL2 connection. My current network sits behind an iptables firewall which runs on a Linux box with two Ethernet interfaces, the WAN interface (eth0) connecting to my ISP via an ADSL modem which once the PPPoA negotiation is over is essentially transparent. The LAN side of the firewall (eth1) currently runs the RFC1918 range 10.0.1/24 which is NATed through the firewall with no problems with everything masquerading through the single static public IP address my ISP has allocated me.

network diagram

I have now been allocated a /29 by my ISP: x.y.z.104/29 - so x.y.z.104 to x.y.z.111 with .104 being the network and .111 the broadcast addresses respectively. My ISP has allocated the .110 address as the router: i.e. this is the public address my MODEM picks up when it connects to the ADSL network and which it allocates eth0.

I need to configure things such that traffic to the servers behind the firewall which have public IP addresses is routed in and out correctly but that the 10.0.1/24 range still masquerades correctly. Could this be done just with iptables or would I also have to define some sort of static route? Would eth1 also have the x.y.z.110 address allocated to it like eth0 has (my ISP has suggested this)?

Also, the firewall would need to be configured to allow inbound SIP and RTP connections to my SIP server/ip pbx (Asterisk). Is iptables the correct tool for the job or should I be looking elsewhere?

  • 1
    I like your network graph. I think what you requires can be done with the SNAT target of netfilter(iptables) instead of the commonly used MASQUERADE OR you can directly assign your allocated addresses to the hosts and (optionally) setup some static routes. Could you tell us how many hosts do you have and do you want some kind of firewall for incoming connections? – billc.cn Dec 1 '12 at 14:56
  • I tried setting up static routes but couldn't get them to work properly: the confusion (for me) being that one of the /29 addresses is on the WAN side of the firewall. I need the 10.0.1/24 network to MASQUERADE, but I don't want any sort of NAT to the x.y.z.110/29, surely? I have about four hosts on the 10.0.1/24 network and two or possibly three on the x.y.z.110/29. – TimGJ Dec 1 '12 at 17:44

This is not completely clear from your description, but it sounds like the ISP has set up the whole /29 as the subnet between their router and yours. x.y.z.110/29 is the ISP side and should be your gateway. Your router/firewall will need an IP address on that subnet too, let's say x.y.z.109/29.

The other 4 usable IP addresses on that subnet (one of which you want to assign for VoIP use) are also supposed to be connected to that subnet, but they're not. See below. But first, here's how it should have been done.

What would have been better is if they'd split the /29 into 2 /30s. x.y.z.108/30 would be a small subnet between their router and yours (with their router at .110 and yours at .109). The other /30, x.y.z.104/30, is a block of 4 IP addresses which they would route to you. Your router/firewall can then further route them inside your network as required.

But since it's a single /29, you have to turn on a feature called proxy ARP on your firewall. It's ugly, but it will fool the ISP's router into thinking that additional servers are directly attached to this /29 subnet.

echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

Now that the traffic for those additional IP addresses is going to get to your router/firewall, you'll need static routes in there to route the additional IP addresses to the servers inside your network that are going to be using them. You can assign and route each of the 4 IP addresses individually as /32s.

You'll want to have an exception in your SNAT or MASQUERADE rules so that traffic coming from inside your network sourced from one of those 4 additional IP addresses is not NATted. I don't know what your iptables rules look like exactly, but something like this:

-A FORWARD -s x.y.z.104/29 -j ACCEPT   # stop if from those IPs
-A FORWARD -o eth1 -maybe-some-other-options -j SNAT   # NAT everything else

On the VoIP server, you can find the public IP address, say x.y.z.105/32, as an additional address on the loopback interface. Make sure your VoIP software is configured to bind to and use that IP address, otherwise it will just use its normal ethernet IP address (10.0.1.something) as the default.

| improve this answer | |
  • Wow, thanks for the very clear explanation. In your ideal example would the router have an additional ip in the .104/30 block? So the router has .109 and .105. This then leaves .106 as the only free ip correct? So it takes at least 7 ip addresses to get at least one public ip? – HaxElit Nov 28 '13 at 14:57
  • The router does not necessarily need an address in the x.y.z.104/30 block. As you observe, there are only 4 IP addresses there, and if you consume one for the router, plus waste 2 as the network broadcast address, that doesn't leave a whole lot. So to save those IP addresses, the router would only have the address on its inside address and have static routes to direct the traffic to all 4 public addresses to the apporpiate SIP server. The target of this route would be the SIP server's internal 10.0.1.x address. The SIP server has the public address(es) as a secondary address on "lo" – Celada Nov 28 '13 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.