On 1/24/20 12:41 PM, Tom H wrote:
On Fri, Jan 24, 2020 at 7:19 PM Mike Wright
<nobody(a)nospam.hostisimo.com> wrote:
> On 1/24/20 9:54 AM, sean darcy wrote:
>>
>> I'm trying to set up a dmz between my internal network and the router.
>> Interface A for internal, interface B for the router. How do I make sure
>> the default route is set to interface B ?
>
> I can give you the manual method for ipv4.
>
> For traffic to cross between the two interfaces forwarding must be
> enabled. That is done in sysctl.conf
>
> net.ipv4.ip_forward=1
>
> Then the default route is assigned to the router interface:
>
> ip route add default via <gateway_ip> dev <router_interface>
It's better to enable forwarding for the NIC that needs it
/proc/sys/net/ipv4/conf/<NIC>/forwarding
/proc/sys/net/ipv6/conf/<NIC>/forwarding
so
net.ipv4.conf.<NIC>.forwarding = 1
net.ipv6.conf.<NIC>.forwarding = 1
Nice pointer, Tom. It's very interesting.
I'm curious to see what would happen if, given the OP's setup, the
inside facing nic had forwarding enabled but the router side nic did
not. Would that create a sort of network diode where NEW traffic within
the host was only allowed to flow in one direction but RELATED and
ESTABLISHED traffic could always return freely unless specifically
blocked by firewall rules.
A lot of ramifications there.
Thanks,
Mike Wright