Topic: Stopping NAT

[cipandales]

Hello !

How to stop NAT for local users ?
I have another router/firewall wich manage this.

Thanks a lot !

[Stefano]

change your server mode from server & gateway to server only from "reconfigure this server" in the admin console (see the documentation)

[cipandales]

Thansk for your answer.

But i need SME server acting like a gateway (ftp, mail etc) but without NAT service.

Do you know how to stop just this service ?

Thanks a lot !

[janet]

cipandales

ftp, mail & most other services are still functional in server only mode. Forward required ports from your router to the sme server.

[cipandales]

I have 2 ip's.
One for domain (SME Server - ftp, mail, web services) and the other ip is for the router.
That's why i need to stop nat on SME Server. Is this possible ?

Thank you

[idp_qbn]

cipandales
I don't know what you are trying to do, or why you need to stop NAT. So we can understand, please describe your network setup - a diagram would be very useful.
eg
using SME as Server/gateway:

[internet] <--> [ADSLmodem/router]  <-->  [SME]         <-->           [local LAN]
            IP :       w.x.y.z/10.0.0.1         10.0.0.2/192.168.1.1        192.168.1.(2- 25


OR using SME as Server only


[internet] <--> [ADSLmodem/router]  <-->  [local LAN including SME]       
            IP :       w.x.y.z/10.0.0.1                 10.0.0.(2- 254)


or whatever your arrangement is.

The diagrams I have shown are a very simple and basic and also very common arrangement. NAT does not have to be stopped on the SME

If you want help, you need to tell us what your problem is, not just the solution you think you want. There may be other ways of achieving the result you need.

Cheers
Ian

[cipandales]

Internet - adslrouter -
- smeserver (external ip - 1.1.1.1) - local network ip (192.168.1.1)                                   
- untangle server (external ip - 1.1.1.2) - local network ip (192.168.1.2)

So, i have 2 servers with different internet ip's. SME Server does ftp, mail, web, internal file sharing and untangle is acting like a router (firewall, nat).
Both of servers have an internal ip and it is easy for users to change the gateway from 192.168.1.2 to 192.168.1.1.

Thank you for you patience.

[janet]

cipandales

It seems to me that the easiest and simplest approach would be to just use 1 external IP for your common gateway/firewall, then share that to your two local networks, and reconfigure your SME server to server only mode.
Alternatively use the one SME server as gateway & firewall connected to a bridged modem, and then add your second network to the list of trusted local networks.

If you want to continue using both external IP's for reasons not revealed, then you will need to look at iptables.

Playing around with iptables rules and making changes to your existing gateway/firewall SME server, can create an insecure server, so you really need to know what you are doing with iptables before doing anything. There have been discussions in these forums by the user arne re how to completely remove the default iptables settings and replace them with something different. This approach is certainly not recommended and you are bound to have issues later, but those posts may assist you to understand the nature of the issue, so search on that author.

You can review the existing default iptables settings with
iptables -L
do this on a server gateway and a server only configuration, and you will see the differences between modes, but these differences are not really what you want as you still need firewall in place for your SME server.

Have a google and do a lot of reading on iptables before you do anything.
If you do not implement the rules in the right order you may appear to have achieved what you want, but have actually created an insecure server.
I have not looked closely, but most likely the existing template structure can be utilised via custom templates to create different rules for local versus external.
Read the Developers Manual for more understanding.
http://wiki.contribs.org/SME_Server:Documentation:Developers_Manual
and see
http://wiki.contribs.org/SME_Server:Documentation:Developers_Manual#Managing_the_firewall