rendered paste bodyeth0 - ADSL - bridged
eth1 - T1 - routed /27
eth2 - LAN - 10.0.0.0/16
eth3 - unused
on the LAN, DHCP hosts are 10.0.0.x and are routed out the ADSL
audio streaming servers are 10.0.1.x
several of these 10.0.1.10x IPs are 1:1 static mapped to corresponding 216.228.7.10x via the T1
[root@router root]# ip addr
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:80:c8:b9:4b:3d brd ff:ff:ff:ff:ff:ff
inet 69.12.250.88/24 brd 69.12.250.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:80:c8:b9:4b:3e brd ff:ff:ff:ff:ff:ff
inet 216.228.7.98/27 brd 216.228.7.127 scope global eth1
inet 216.228.7.100/32 scope global eth1
inet 216.228.7.101/32 scope global eth1
inet 216.228.7.102/32 scope global eth1
inet 216.228.7.103/32 scope global eth1
inet 216.228.7.104/32 scope global eth1
inet 216.228.7.105/32 scope global eth1
inet 216.228.7.106/32 scope global eth1
inet 216.228.7.107/32 scope global eth1
inet 216.228.7.108/32 scope global eth1
inet 216.228.7.109/32 scope global eth1
inet 216.228.7.110/32 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:80:c8:b9:4b:3f brd ff:ff:ff:ff:ff:ff
inet 10.0.0.1/16 brd 10.0.255.255 scope global eth2
5: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 100
link/ether 00:80:c8:b9:4b:40 brd ff:ff:ff:ff:ff:ff
[root@router root]# ip route
216.228.7.103 dev eth1 scope link
216.228.7.102 dev eth1 scope link
216.228.7.101 dev eth1 scope link
216.228.7.100 dev eth1 scope link
216.228.7.107 dev eth1 scope link
216.228.7.106 dev eth1 scope link
216.228.7.105 dev eth1 scope link
216.228.7.104 dev eth1 scope link
216.228.7.110 dev eth1 scope link
216.228.7.109 dev eth1 scope link
216.228.7.108 dev eth1 scope link
216.228.7.96/27 dev eth1 scope link
69.12.250.0/24 dev eth0 scope link
10.0.0.0/16 dev eth2 scope link
127.0.0.0/8 dev lo scope link
default via 69.12.250.1 dev eth0
[root@router root]# ip rule
0: from all lookup local
32765: from 10.0.1.0/24 lookup SDSL2
32766: from all lookup main
32767: from all lookup 253
[root@router root]# ip route list table SDSL2
default via 216.228.7.97 dev eth1
[root@router root]# iptables -L -vn
Chain INPUT (policy DROP 1142 packets, 97786 bytes)
pkts bytes target prot opt in out source destination
4072 431K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
14 2358 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
1655 138K ACCEPT all -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW
1 48 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113
Chain FORWARD (policy ACCEPT 83967 packets, 62M bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- eth0 eth0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1978 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1978 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:2002 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:2002 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:4156 reject-with icmp-port-unreachable
0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:4156 reject-with icmp-port-unreachable
0 0 REJECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 flags:0x16/0x02 reject-with icmp-port-unreachable
0 0 REJECT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 flags:0x16/0x02 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 4920 packets, 526K bytes)
pkts bytes target prot opt in out source destination
[root@router root]# iptables -t nat -L -vn
Chain PREROUTING (policy ACCEPT 1687 packets, 143K bytes)
pkts bytes target prot opt in out source destination
3 509 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.100 to:10.0.1.100
2 122 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.101 to:10.0.1.101
4 213 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.102 to:10.0.1.102
0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.103 to:10.0.1.103
3 166 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.104 to:10.0.1.104
4 231 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.105 to:10.0.1.105
0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.106 to:10.0.1.106
0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.107 to:10.0.1.107
0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.108 to:10.0.1.108
88 6725 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.109 to:10.0.1.109
3 153 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.110 to:10.0.1.110
Chain POSTROUTING (policy ACCEPT 555 packets, 36723 bytes)
pkts bytes target prot opt in out source destination
271 13922 SNAT all -- * eth0 10.0.0.0/24 0.0.0.0/0 to:69.12.250.88
0 0 SNAT all -- * eth1 10.0.1.100 0.0.0.0/0 to:216.228.7.100
0 0 SNAT all -- * eth1 10.0.1.101 0.0.0.0/0 to:216.228.7.101
0 0 SNAT all -- * eth1 10.0.1.102 0.0.0.0/0 to:216.228.7.102
35 2343 SNAT all -- * eth1 10.0.1.103 0.0.0.0/0 to:216.228.7.103
0 0 SNAT all -- * eth1 10.0.1.104 0.0.0.0/0 to:216.228.7.104
0 0 SNAT all -- * eth1 10.0.1.105 0.0.0.0/0 to:216.228.7.105
0 0 SNAT all -- * eth1 10.0.1.106 0.0.0.0/0 to:216.228.7.106
0 0 SNAT all -- * eth1 10.0.1.107 0.0.0.0/0 to:216.228.7.107
2 100 SNAT all -- * eth1 10.0.1.108 0.0.0.0/0 to:216.228.7.108
8 1946 SNAT all -- * eth1 10.0.1.109 0.0.0.0/0 to:216.228.7.109
0 0 SNAT all -- * eth1 10.0.1.110 0.0.0.0/0 to:216.228.7.110
Chain OUTPUT (policy ACCEPT 447 packets, 28544 bytes)
pkts bytes target prot opt in out source destination