# Routing through a single nic server?

## sven_sol

Morning all,

Bit of an overview first, with some fake IP addresses:

1. we have a server on the network with a single Gb network card on there. On there we have email system (inbound/outbound smtp) , squid, web server, dns, samba etc... and dhcp too.

2. ADSL router, NAT'ing all traffic through to a Watchguard firewall.  Internal network sits behind watchguard, acting as the gateway.

Server: 192.168.0.1/24

Firewall: 192.168.0.254/24

Network: 192.168.0.100 -> 192.168.0.200, set via dnsmasq on server, telling the clients the network gateway is the firewall, dns is the server.

What I want to accomplish is turn the server into a transparent gateway for the network so that all traffic logged via squid, but I will still need access to the other services provided by the server.

Obviously this needs to be iptables. Will this need iproute too?

Also, anyone got any pointers (or rules already  :Wink: !?) that I can use?

----------

## Moriah

I am doing something similar.  I have a gentoo box running iptables and openvpn.  It is coloced at my isp's noc.  The isp sends my colo box its own ip address along with a cidr block of static ip addresses for my network.  openvpn sets up a tunnel to the gateway box on my netwrok, which de-encapsulates the cidr block sent thru the tunnel.

So my colo box only has a single ethernet nic, but handles 4 networks: its own ip address, the tunnelled cidr block, the tunnel itself, the gateway at the far end of the tunnel.  Counting localhost, that would be 5 networks.  Each has its own routing rules.

I think you will want to do something similar -- divide traffic into subnets and set up routing rules for each.

----------

## sven_sol

so will the server need to have 2 ip addresses?

i.e. 192.168.0.1/24 and 192.168.0.2/24?  Can it not do it all with one?

----------

## Moriah

No, you need 2 *NETWORKS* to route traffic thru.    :Surprised: 

They can both co-exist on the same ethernet, and flow thru the same NIC.

See http://tldp.org/HOWTO/Adv-Routing-HOWTO/ for tons of information on this stuff.

----------

## sven_sol

Ok, before I start to get rather confused lets take a few small steps first..   :Embarassed: 

Say I want to enable the transparent proxy of squid, I turn on the transparent option in squid.conf.  Will I need to also need to configure iptables along the lines of this posting and then

```
net.ipv4.ip_forward=1
```

Am I getting the wrong end of many different sticks here?

----------

## Moriah

My understanding is that you need a network to connect to each side of the proxy.  You don't need 2 nics, just to networks.  I havenn't done this in a *LOOOONG* time, so I am very likely rusty and out of date.  The idea is you set up, say wildnet a 192.168.1.0/24 and tamenet as 192.168.2.0/24.  You put both of these on a single nic.  The old way was to use ipconfig with colon-notation, but I think the new way with iproute is in the docs I mentioned earlier.  Once you have 2 networks on the same physical ethernet nic, everything else is just as if you had 2 nics.  Yes, you need advanced routing turned on in the kernel, and you need forwarding enabled.

----------

## sven_sol

so is there no way of doing it on the same network?

----------

## Moriah

Maybe there is, but a network is just a network address and an netmask; you can have multiple networks on the same physical ethernet cable and the same nic.  The need for 2 networks is to make the routing work out.  

It may be possible to do it some other way, but I am not up to date on squid and its capabilities.  I am assuming that it has essentially 2 ports -- one on 80 and the other on (typically) 8080.  To work transparently, you would have to set up iptables to block the port 8080 on the input side, and nat those packets to a different network on that network as port 80 traffic.

----------

## Moriah

Off topic side note:

"Tua mater tam antiqua ut linguam latinam loquatur "

My Latin is pretty rusty.  I took Latin over 40 years ago.  The best I can translate you sig is something about "your mother speaks in the old latin tongue", but I can't remember what "tam" and "ut" mean, so I probably am a bit off base.  What is the correct rendering?

----------

## sven_sol

I guess I'll just have to try some configurations and see what I can work out   :Confused: 

Sidenote: Roughly translated it says "Yo momma so old, she speaks latin!" Google is great for finding useful things and also crap like that too  :Wink: 

----------

## Moriah

Well then, given that I took 3 years of it over 40 years ago, I guess I'm so old I do to -- what I can remember of it.    :Laughing: 

----------

