I know this is wrong,wacko,wierd, but if it can be done I would appreciate knowing how. I have searched this forum, but not found the answer. Also I have tried many things but not accomplished what I want.
Currently this router is at 2.8.28 but scheduled for an upgrade soon.
I have a location that has 2 internet feeds. 1 is only a 256K link. The other is a 5Meg link. The 5 Meg link only gives 1 IP. The 256K link has a /26. I have a customer that needs remote access to equipment (ssh) I want to assign them an IP from the /26 for remote access but Masqeurade the traffic outbound for normal internet traffic.
eth 1 - 5meg IP assigned by DHCP
eth2 256K Static IP 64.156.x.x
eth 3 has 2 IPs 192.168.168.x and 8.7.x.x The 192.168.168 are masqueraded to eth1, the 8.7.x.x/26 are staticaly routed out the 256K link, untill now I have just used this for my own management purposes.
Can I masq there trafiic outbound but allow them access to it remotely?
read about natting in manual and consider port forwarding as your solution. but not default port 22 (if you want to access your router through that port) but any other would do without problems
so he could access equipment even if it has internal address only
port forwarding is not what I want to do. And yes I have read the manual, but thanks for the reply.
I have a block of public IP’s and I want to assign them one. But when traffic is outbound normal internet surfing and such to masq this public to the IP on Eth1.
When a person needs access to there network they can access it directly by the IP assigned to their router. Not port mapped they have IT person and they want to manage access to the resources behind the router.
Just use a dstnat with a dst-addr match on the 8 range. Optionally add a protocol=tcp and dst-port=xxx. Don’t add any specific srcnat and the outbound will go through masq nat rule. note that hosts in your /26 range will not be replied to through masq nat.
Well I don’t know how the rest of the world does this but I just use dst-nat and forward all ports to the desired internal IP address. (Their IT guy(s) like to be able to hide what ports they set up what on to what server…so I just send all ports wherever they want it and let them sort it out). Use connection tracking and ROS will keep it straight.
We use this all the time - haven’t had any issues… And it (ROS) still lets the users network ‘choose’ if you will, normal Internet when they are coming from their network to the Internet.
The block of IP’s is on the same interface that the customer connects to. DST-NAT will not work in this scenario. The interface has 2 IP’s 8.7.x.x and 192.168.168.x
I want to assign the customer an 8.7.x.x IP and but masq the traffic when it is normal web traffic. But allow them to access to there router with the 8.7.x.x IP directly.
Thanks to those that have replied but I do not need alturnative methods, but how to do this if it can be done. I have tried marking the traffic with as a flow when interface = and IP = 8.7.x.x/32 and masq that to eth1. But it does not work