# Somewhat complicated network routing.

## gryzor

Hi!

My gentoo box gets dhcp from adsl-modem on eth0.

I'd like to put another cable into the adsl-modem and bridge eth1 <-> eth2 so my stationary gets its own public ip, this for filtering purposes. 

At the same time, I'd like to have eth3 connected to a gigabit switch with my 2nd gentoo-box (samba), 3rd (eebox with xbmc connected to the TV) and et all, while still being able to access to<>from eth3s "private" 192.168.0.0/24 network on the bridged network (eth2 of course, since I want to browse its shares), by assigning a secondary IP to the NIC on the stationary PC.

I presume this this possible, I'd just like a few pointers how.

It'll (or, it SHOULD) look something like:

eth0: DHPC (ADSL)

eth1: Bridged (ADSL ->)

eth2: Bridged (ADSL <- +routing to eth3)

eth3: LAN with access to the non dual-homed, but 2 IP-carrying Win7-box reachable at eth2.

Any OOPS I might run into? Like the Win box on ETH2 not being able to both fetch DHCP from the bridge while having a LAN-ip to send/retrieve packets from ETH3?  How would I configure this on the front-end gentoo box?

Please advice, TIA.

----------

## yzg

(A) Do you want something like this?

```

-----------------

| adsl modem |

-----------------

         |  192.168.0.1

         |

         |  192.168..0.2

-------------------------------------------------------------------

|                            1st Gentoo                                      |

-------------------------------------------------------------------

         | 192.168.3.1

         |

         |

         |

----------------------------------------------------------

|        switch                                                     |

----------------------------------------------------------

         |                           |

         |                           |

         | 192.168.3.2         | 192.168.3.3

----------------          ----------------

| 2nd Gentoo |         | eebox        |

----------------          ----------------

```

(B) Do you want 2nd Gentoo, etc to access internet?

----------

## 1clue

As nearly as I can tell, you want a router with filtering on it hooked up to the ADSL, and everything else hooked up to a local network?

The router needs two network cards, and then put a switch on your internal network.  It's actually fairly common to do this, although it's been a long time since I messed with a Linux-based firewall.  I used to run an office with a Linux firewall and about 80 hosts inside.  It took awhile to figure the filtering rules out, but it all worked out in the end.

IMO, if you only want private access and maybe one or two ports open, you can't beat an appliance firewall.  On the other hand, if you're trying to learn Linux firewall rules and need a project, then be my guest.

----------

## gryzor

 *yzg wrote:*   

> (A) Do you want something like this?
> 
> ...
> 
> 

 

Actually, no -- but the drawing will be very helpful, thanks  :Smile: 

```

-----------------

| adsl modem |

-----------------

         |   |

         |--+-------- eth0 public IP 

         |   |----------------------------- eth1 bridged with filtering to eth2

-------------------------------------------------------------------

|                            1st Gentoo                                      |

-------------------------------------------------------------------

             | eth2 bridged + second ip, say 192.168.9.1 (eth2:0)

             |

             |

             |

---------------------------------------------------------- 

|        switch                                                     |

---------------------------------------------------------- 

            |                                            |        |

            |                                            |        |

            | public IP via the bridge and    |        | 192.168.9.11 

----------------   access to private          |    ----------------

| win box      |   network via interface    |   | eebox        |

----------------   aliasing                        |   ----------------

                                                          |

                                                          | 192.168.9.10

                                              --------------------

                                             | second gentoo |

                                             --------------------

```

edit: shucks, I messed that up -- oh well, it's just two boxes with private 192.168.9.0/24 IPs anyhow  :Smile: 

The reason it has to be two nics and cables into the dsl modem is because it locks each port to one mac-address. You can't extract two ips from from the same port even if you manipulate it to use two sets of source arps.

 *yzg wrote:*   

> (A) Do you want something like this?
> 
> (B) Do you want 2nd Gentoo, etc to access internet?

 

Yeah, but I presume that will be a simple fact to enable forwarding and setup eth2:0<->eth0 like any common linux firewall. Unless this has any known effects on eth2 and eth1 (notice: eth2:0 and eth2 will be treated as two separate interfaces, but in reality is not).

Perhaps this is too cumbersome...

----------

## 1clue

Is this an exercise in networking and routing, or are you just trying to get a network going?

Why do you need to have two IPs on the ADSL?

Why do you want two cables going from the ADSL to the first Gentoo box?

Maybe you shouldn't describe this as boxes and cables, but rather as networks that you want and their access to each other?  And maybe a non-text graphic?

Thanks.

----------

## yzg

I'm confused. Why do you need two connections to the adsl modem and public ip assigned to win computer? You have to explain to us what do you want to achieve or we will not be able to help you.

----------

## Jaglover

A sane home net would look like this:

**

ADSL in bridge mode (one NAT is bad enough, why double)

|

NAT router, with additional caching DNS and NTP (and DHCP if you cannot live without it)

|

Switch

|

Computers and optional wireless access point (again, no NAT in AP)

**

To access computers behind NAT from internet use port forwarding.

----------

## MacGyver031

You could do it very easy: 

Switch 1: ADSL-Modem, "Router", PC 1 and PC2

Switch 2: Intranet.

On the gentoo-router you install openvpn as well as on the PC which should have access to samba. By doing so, you could take the pc anywhere in the internet and would have the connection.

Secondly: If you have a route from samba to the "internet", anyone in the world could access your data! With a VPN, it gets difficult for pseudo hacker.

----------

