Role of multiple network interfaces

Question

Hi,
I'm trying to setup a Mac Mini Server to act as a gateway and to offer various services from inside and outside of my office. For me this is some kind of test setup before I may look into getting a bigger machine for this job.
Because a gateway needs two ethernet interfaces I got an Apple USB-Ethernet adapter which technically works without problems. However since the USB-Ethernet is slower than the internal ethernet interface of the Mac Mini I want to connect the USB interface to the internet (fixed IP, DNS forward set, reverse in work) and the faster internal interface to my internal network.
The server is set up to make NAT but DHCP is done by another server. So the internal address is also manually set. Also there is an internal DNS Server I've setup the server to use it's own DNS service.
It took me some time to figure out how to make the USB interface (en2) the primary interface by turning off the internal interface (en0) during installation and adding it at a later time. So when I'm now doing a changeip -checkhostname I can see that my external address is my primary interface and my public hostname is correct.
However my biggest problem at the moment is that it seems as if all services are bound to the internal interface/network (en0) and I'm not able to access services like VPN, iChat or web from the internet or by using the public hostname.
Do I have to somehow tell all these services to explicitly bind to the external interface/address? Or is there no other way than to use en0 as the external interface in my configuration?
Thanks,
Alex

Answer 1

Please search for existing discussions of establishing static IP routes; this stuff can and does work, but requires manual set-up. IP selects a primary NIC in the absence of a known route regardless of the NIC the message arrived on, which means the Mac box doesn't work like you'd expect without some help. [Here's one discussion|http://discussions.apple.com/message.jspa?messageID=5697532], and there are others.
Mac boxes don't make particularly easy nor effective nor efficient nor economical firewalls in my experience, and this is inherent in the design differences between a Mac and a dedicated firewall. External firewalls are an added expense for a small network, but (in my experience) tend to have advantages over using a Mac box doubling as a firewall.
Given the number of folks that try this particular configuration, it would be useful for Apple to provide some guidance and some tools here to set up the static routes and to operate the Mac as a router (in some future release of Mac OS X Server after Snow Leopard Server 10.6); you're going to be using the bash shell to get this stuff going.