Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router that has 5 static ip addresses set on it. These external static IP's are mapped to internal IP's on our LAN. We currently have no firewall or proxy set up, so I cannot monitor user bandwidth usage or block content.

I have set up an Ubuntu firewall with 2 network cards and Squid proxy and am able to connect to the internet via the firewall from a workstation within the LAN.

I am also familiar with port forwarding through the Ubuntu firewall, however, how can I map an external IP address to an address on the internal IP ? The router has a static IP address on the LAN (, my Ubuntu Firewall has a static IP address of on the "WAN" network card and an address of on the "LAN" network card. My clients on the LAN are within the address range of -

Any help would be appreciated.


share|improve this question
You initially said that "These external static IP's are mapped to internal IP's on our LAN." and then ask the question: "how can I map an external IP address to an address on the internal IP". Can you explain in more detail what you are trying to accomplish? – Kevin Bowen Dec 12 '12 at 12:13
Do your router supports NAT ? – K.K Patel Dec 12 '12 at 12:25
Do you have taken static ip from ISP ? – K.K Patel Dec 12 '12 at 12:26
Sorry, yes, my current setup excludes the Ubuntu Firewall so my LAN workstations are connected directly to the router, so they are all on the same network range ie - I am wanting to use Ubuntu as a firewall and proxy but still require the static IP to be passed through to workstations on the LAN. – Oliver Dec 12 '12 at 12:27
Yes, the static IP is from the ISP and the router does support NAT. – Oliver Dec 12 '12 at 12:28

I would suggest that you set up your squid proxy machine to have multiple IP addresses on the WAN facing side - one corresponding to each of your 5 client machines on the LAN (say,,, and

You then set up a squid ACL and tcp_outgoing_address rule as described here to map your internal client LAN addreses to one of the WAN facing IP addresses on squid, e.g. maps to, maps etc).

Finally you set up your router to NAT your first external IP to, your second one to, and so on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.