4

I have a couple of networks that have multiple IP addresses, and where I have absolutely no choice as to the equipment used for the network's edge router (the device that connects both to the LAN and the ISP). The system that is at the network's edge is inadequate for a firewall, and so I want to use a Linux box to perform the firewalling functionality. However, what I do not want to do is subnet; one of the networks this needs to be done on is a /29, and the other is a /28.

For the sake of this example, we'll call these networks 10.0.0.0/29 (network A) and 10.0.1.0/28 (network B).

On both networks A and B, the last usable IP address is the one that is used for the ISP's required gateway device (which is a combined cable modem and four-port Ethernet switch). So, on A it is 10.0.0.6 and on B it is 10.0.1.14. (Note also that these devices perform NAT functions, using its claimed address for the NAT gateway as well.)

Now, what I want is to have a system on network A, give it IP 10.0.0.1, and make it the firewall for the other hosts on the network (that is, 10.0.0.2, 3, 4, and 5).

However, I am somehow not figuring out how I can do that. I do not have control of the routing table on the ISP's gateway device, so I cannot tell it to route packets to my network via a gateway that I control on my network.

Physically, the network connection comes in on a coax cable into the cable modem. The cable modem's four gigabit ports are fanned out throughout the network:

  • One is connected to a server system that has a bridge and four additional ports on it.
  • One is connected to a wireless router, that feeds my wireless network in the upstairs of my home.
  • One is connected to a workstation.
  • One is connected to a printer.

So logically, it is one network segment. What I would like to do is hook the server up to the device on a single port, and have the server feed the network with its multiple port network card. But I can't think of how to do that without breaking IP; I am handed a /28 on this network (and as I mentioned earlier, a /29 on the other) and I cannot afford to lose any IP addresses to subnetting, I'm using most all of them.

Any ideas? And also, if I have left out anything relevant, let me know.

Improve this question

1 Answer 1

Reset to default
5

Sounds like you are just looking for a bridging firewall.

http://www.cryptolife.org/index.php/Linux_Bridge_Firewall

Graphic below is from the link above:

enter image description here

http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge

"A bridge is a way to connect two Ethernet segments together in a protocol independent way. Packets are forwarded based on Ethernet address, rather than IP address (like a router). Since forwarding is done at Layer 2, all protocols can go transparently through a bridge."

Improve this answer
1
  • Awesome. I don't know why I didn't think about search for the term "bridge firewall", but thank you so much for pointing me in the right direction.
    – Michael Trausch
    Jul 1, 2011 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .