eth0 - ADSL - bridged eth1 - T1 - routed /27 eth2 - LAN - 10.0.0.0/16 eth3 - unused on the LAN, DHCP hosts are 10.0.0.x and are routed out the ADSL audio streaming servers are 10.0.1.x several of these 10.0.1.10x IPs are 1:1 static mapped to corresponding 216.228.7.10x via the T1 [root@router root]# ip addr 1: lo: mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo 2: eth0: mtu 1500 qdisc pfifo_fast qlen 100 link/ether 00:80:c8:b9:4b:3d brd ff:ff:ff:ff:ff:ff inet 69.12.250.88/24 brd 69.12.250.255 scope global eth0 3: eth1: mtu 1500 qdisc pfifo_fast qlen 100 link/ether 00:80:c8:b9:4b:3e brd ff:ff:ff:ff:ff:ff inet 216.228.7.98/27 brd 216.228.7.127 scope global eth1 inet 216.228.7.100/32 scope global eth1 inet 216.228.7.101/32 scope global eth1 inet 216.228.7.102/32 scope global eth1 inet 216.228.7.103/32 scope global eth1 inet 216.228.7.104/32 scope global eth1 inet 216.228.7.105/32 scope global eth1 inet 216.228.7.106/32 scope global eth1 inet 216.228.7.107/32 scope global eth1 inet 216.228.7.108/32 scope global eth1 inet 216.228.7.109/32 scope global eth1 inet 216.228.7.110/32 scope global eth1 4: eth2: mtu 1500 qdisc pfifo_fast qlen 100 link/ether 00:80:c8:b9:4b:3f brd ff:ff:ff:ff:ff:ff inet 10.0.0.1/16 brd 10.0.255.255 scope global eth2 5: eth3: mtu 1500 qdisc noop qlen 100 link/ether 00:80:c8:b9:4b:40 brd ff:ff:ff:ff:ff:ff [root@router root]# ip route 216.228.7.103 dev eth1 scope link 216.228.7.102 dev eth1 scope link 216.228.7.101 dev eth1 scope link 216.228.7.100 dev eth1 scope link 216.228.7.107 dev eth1 scope link 216.228.7.106 dev eth1 scope link 216.228.7.105 dev eth1 scope link 216.228.7.104 dev eth1 scope link 216.228.7.110 dev eth1 scope link 216.228.7.109 dev eth1 scope link 216.228.7.108 dev eth1 scope link 216.228.7.96/27 dev eth1 scope link 69.12.250.0/24 dev eth0 scope link 10.0.0.0/16 dev eth2 scope link 127.0.0.0/8 dev lo scope link default via 69.12.250.1 dev eth0 [root@router root]# ip rule 0: from all lookup local 32765: from 10.0.1.0/24 lookup SDSL2 32766: from all lookup main 32767: from all lookup 253 [root@router root]# ip route list table SDSL2 default via 216.228.7.97 dev eth1 [root@router root]# iptables -L -vn Chain INPUT (policy DROP 1142 packets, 97786 bytes) pkts bytes target prot opt in out source destination 4072 431K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 14 2358 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW 1655 138K ACCEPT all -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW 1 48 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 Chain FORWARD (policy ACCEPT 83967 packets, 62M bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- eth0 eth0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1978 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1978 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:2002 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:2002 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:4156 reject-with icmp-port-unreachable 0 0 REJECT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:4156 reject-with icmp-port-unreachable 0 0 REJECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 flags:0x16/0x02 reject-with icmp-port-unreachable 0 0 REJECT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 flags:0x16/0x02 reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT 4920 packets, 526K bytes) pkts bytes target prot opt in out source destination [root@router root]# iptables -t nat -L -vn Chain PREROUTING (policy ACCEPT 1687 packets, 143K bytes) pkts bytes target prot opt in out source destination 3 509 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.100 to:10.0.1.100 2 122 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.101 to:10.0.1.101 4 213 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.102 to:10.0.1.102 0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.103 to:10.0.1.103 3 166 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.104 to:10.0.1.104 4 231 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.105 to:10.0.1.105 0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.106 to:10.0.1.106 0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.107 to:10.0.1.107 0 0 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.108 to:10.0.1.108 88 6725 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.109 to:10.0.1.109 3 153 DNAT all -- eth1 * 0.0.0.0/0 216.228.7.110 to:10.0.1.110 Chain POSTROUTING (policy ACCEPT 555 packets, 36723 bytes) pkts bytes target prot opt in out source destination 271 13922 SNAT all -- * eth0 10.0.0.0/24 0.0.0.0/0 to:69.12.250.88 0 0 SNAT all -- * eth1 10.0.1.100 0.0.0.0/0 to:216.228.7.100 0 0 SNAT all -- * eth1 10.0.1.101 0.0.0.0/0 to:216.228.7.101 0 0 SNAT all -- * eth1 10.0.1.102 0.0.0.0/0 to:216.228.7.102 35 2343 SNAT all -- * eth1 10.0.1.103 0.0.0.0/0 to:216.228.7.103 0 0 SNAT all -- * eth1 10.0.1.104 0.0.0.0/0 to:216.228.7.104 0 0 SNAT all -- * eth1 10.0.1.105 0.0.0.0/0 to:216.228.7.105 0 0 SNAT all -- * eth1 10.0.1.106 0.0.0.0/0 to:216.228.7.106 0 0 SNAT all -- * eth1 10.0.1.107 0.0.0.0/0 to:216.228.7.107 2 100 SNAT all -- * eth1 10.0.1.108 0.0.0.0/0 to:216.228.7.108 8 1946 SNAT all -- * eth1 10.0.1.109 0.0.0.0/0 to:216.228.7.109 0 0 SNAT all -- * eth1 10.0.1.110 0.0.0.0/0 to:216.228.7.110 Chain OUTPUT (policy ACCEPT 447 packets, 28544 bytes) pkts bytes target prot opt in out source destination