Sunday, January 2, 2011

can I use a published IP address to "hide" multiple DMZ servers, and direct traffic to the correct server based on the service involved

"All you do is create a STATIC NAT rule with the proper settings. (actually two rules in NAT tab, and two in the rulebase)

lets say your outside IP is 1.1.1.1 and you have two servers inside at 192.168.1.1 (ftp) and 192.168.1.2 (http)

    On the NAT tab,
    orig src = any
    orig dest = 1.1.1.1
    orig svc = ftp
    xlat src = any
    xlat dest = 192.168.1.1
    xlat svc = original

    orig src = any
    orig dest = 1.1.1.1
    orig svc = http
    xlat src = any
    xlat dest = 192.168.1.2
    xlat svc = original

and then the obvious rulebase entries to allow packets to enter/leave various interfaces."

No comments: