12:16 p.m.
Hi, I'd sure appreciate help with getting my router and host to work!
Problem-
FC2 Host cannot get Internet connection through FC2 Router.
Description-
Both FC2 machines use to work fine via a D-Link firewall router. I
removed the D-Link to make my own Router, connected via CrossOver cable,
to Host. (and yes it is a belkin #r7j304 5e 'crossover' cable, -I
checked). The Router works fine, and gets Internet connection - the Host
does not!
Host at 192.168.1.10 can be PINGed and nmapped successfully by Router
without packet loss.
I have been using RedHat9 Bible by Christopher Negus as a guide, pp616
etc. but perhaps I missed something, or there's a major change w/ FC2 to
get this to work, or i've just confused IP addressing?
Any help appreciated...
The ROUTER
(Gigabyte GA7VRXP, eth0 is onboard RealTek NIC, & Netgear PCI card for
eth1)
1_ router-
blue.myvnc.com
eth0 - dhcp
eth1 - 192.168.1.1
SubNet Mask 255.255.255.0
Default Gateway: 0.0.0.0
2_
/etc/sysconfig/network reads:
NETWORKING=yes
HOSTNAME='blue.myvnc.com'
GATEWAYDEV=eth0
2A_ in /etc/hosts reads:
127.0.0.1 localhost.localdomain localhost
192.168.1.10 red.myvnc.com red
#red is the host
3_
/etc/sysctl.conf reads:
net.ipv4.ip_forward = 1
4_
Added FORWARD rules
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
# cp /etc/sysconfig/iptables /etc/sysconfig/iptables.old
cp: overwrite `/etc/sysconfig/iptables.old'? y
# iptables-save > /etc/sysconfig/iptables
# /etc/init.d/network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: [ OK ]
Setting network parameters: [ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
5_ checked rules have been added
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
ACCEPT all -- 192.168.0.0/16 anywhere
ACCEPT all -- anywhere 192.168.0.0/16
DROP all -- !192.168.0.0/16 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
The HOST MACHINE
Asus A7N8X Deluxe, with onboard 3Com eth0, and Nvidia eth1
The cable IS connected to eth0, I checked physically and in network
settings to see that eth0 corresponds to 3Com, not Nvidia.
6_ eth0
192.168.1.10
SubNet Mask 255.255.255.0
Default Gateway 192.168.1.1
7- /etc/hosts - the host can see itself and the router:
127.0.0.1 localhost.localdomain red.myvnc.com red
192.168.1.1 blue.myvnc.com blue
8_ no firewall present on host, I checked-
#iptables -L
Chain INPUT (Policy ACCEPT)... target... <no values >
[FORWARD & OUTPUT, same, no values]
What am I missing? the default gateway in part 1_ or 6_ above ?
Is it the SubNet Masks?
Any help appreciated, tia
Chris
12:29 p.m.
Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not a 16
bit ( 255.255.0.0 )
It would be your firewall rules that are blocking you.....
These two lines......
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
the ip's should be 192.168.1.0/24 not 192.168.0.0/16
the way it's writen, you drop everthing on your subnet.
Michael Floyd
-----Original Message-----
From: fedora-list-bounces(a)redhat.com
[mailto:fedora-list-bounces@redhat.com]On Behalf Of fedora
Sent: June 15, 2004 1:17 PM
To: fedora-list(a)redhat.com
Subject: nat masquerade router
Hi, I'd sure appreciate help with getting my router and host to work!
Problem-
FC2 Host cannot get Internet connection through FC2 Router.
Description-
Both FC2 machines use to work fine via a D-Link firewall router. I
removed the D-Link to make my own Router, connected via CrossOver cable,
to Host. (and yes it is a belkin #r7j304 5e 'crossover' cable, -I
checked). The Router works fine, and gets Internet connection - the Host
does not!
Host at 192.168.1.10 can be PINGed and nmapped successfully by Router
without packet loss.
I have been using RedHat9 Bible by Christopher Negus as a guide, pp616
etc. but perhaps I missed something, or there's a major change w/ FC2 to
get this to work, or i've just confused IP addressing?
Any help appreciated...
The ROUTER
(Gigabyte GA7VRXP, eth0 is onboard RealTek NIC, & Netgear PCI card for
eth1)
1_ router-
blue.myvnc.com
eth0 - dhcp
eth1 - 192.168.1.1
SubNet Mask 255.255.255.0
Default Gateway: 0.0.0.0
2_
/etc/sysconfig/network reads:
NETWORKING=yes
HOSTNAME='blue.myvnc.com'
GATEWAYDEV=eth0
2A_ in /etc/hosts reads:
127.0.0.1 localhost.localdomain localhost
192.168.1.10 red.myvnc.com red
#red is the host
3_
/etc/sysctl.conf reads:
net.ipv4.ip_forward = 1
4_
Added FORWARD rules
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
# cp /etc/sysconfig/iptables /etc/sysconfig/iptables.old
cp: overwrite `/etc/sysconfig/iptables.old'? y
# iptables-save > /etc/sysconfig/iptables
# /etc/init.d/network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: [ OK ]
Setting network parameters: [ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
5_ checked rules have been added
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
ACCEPT all -- 192.168.0.0/16 anywhere
ACCEPT all -- anywhere 192.168.0.0/16
DROP all -- !192.168.0.0/16 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
The HOST MACHINE
Asus A7N8X Deluxe, with onboard 3Com eth0, and Nvidia eth1
The cable IS connected to eth0, I checked physically and in network
settings to see that eth0 corresponds to 3Com, not Nvidia.
6_ eth0
192.168.1.10
SubNet Mask 255.255.255.0
Default Gateway 192.168.1.1
7- /etc/hosts - the host can see itself and the router:
127.0.0.1 localhost.localdomain red.myvnc.com red
192.168.1.1 blue.myvnc.com blue
8_ no firewall present on host, I checked-
#iptables -L
Chain INPUT (Policy ACCEPT)... target... <no values >
[FORWARD & OUTPUT, same, no values]
What am I missing? the default gateway in part 1_ or 6_ above ?
Is it the SubNet Masks?
Any help appreciated, tia
Chris
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
12:44 p.m.
Am Di, den 15.06.2004 schrieb Michael Floyd um 19:29:
Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not
a 16
bit ( 255.255.0.0 )
It would be your firewall rules that are blocking you.....
Right.
These two lines......
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
the ip's should be 192.168.1.0/24 not 192.168.0.0/16
the way it's writen, you drop everthing on your subnet.
No :) That doesn't matter. 192.168.0.0/16 includes the 192.168.1.0/24
net. He is just bit more permissive than it needs. But does no harm.
What is causing the blocking is:
iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
It drops all incoming traffic not being from the private address range.
Thus packages from public internet are dropped.
What you intend is better placed to the INPUT chain.
Michael Floyd
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) on Athlon CPU kernel 2.6.6-1.435
Serendipity 19:36:44 up 16:03, 8 users, 0.31, 0.29, 0.31
12:54 p.m.
Well, at least I tried.
I was along the right lines though and Rodolfo J. Paiz hit it right on the
head.
I think I'll just stick to reading instead of awnsering.
And BTW. I agree with the "FC2 Issues" thread.... Those kind of bugs should
NOT make it into a offical release that isn't an RC.
( alas, I too was bitten by the duel boot bug and so where quite a few
others that I know. )
-----Original Message-----
From: fedora-list-bounces(a)redhat.com
[mailto:fedora-list-bounces@redhat.com]On Behalf Of Alexander Dalloz
Sent: June 15, 2004 1:45 PM
To: For users of Fedora Core releases
Subject: Re: nat masquerade router
Am Di, den 15.06.2004 schrieb Michael Floyd um 19:29:
Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not
a 16
bit ( 255.255.0.0 )
It would be your firewall rules that are blocking you.....
Right.
These two lines......
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
the ip's should be 192.168.1.0/24 not 192.168.0.0/16
the way it's writen, you drop everthing on your subnet.
No :) That doesn't matter. 192.168.0.0/16 includes the 192.168.1.0/24
net. He is just bit more permissive than it needs. But does no harm.
What is causing the blocking is:
iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
It drops all incoming traffic not being from the private address range.
Thus packages from public internet are dropped.
What you intend is better placed to the INPUT chain.
Michael Floyd
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) on Athlon CPU kernel 2.6.6-1.435
Serendipity 19:36:44 up 16:03, 8 users, 0.31, 0.29, 0.31
12:58 p.m.
This is how i do it on a box that has Taolinux, I imagine it would be
the same on Fedora:
## /etc/sysconfig/itpables
*nat
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
-A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# EOF
In addition I had to add the following into my /etc/sysctl.conf:
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
Try this configuration out, let me know if it works for you.
Erik
On Tue, 15 Jun 2004 13:54:02 -0400, Michael Floyd <michael.floyd(a)cgi.com> wrote:
Well, at least I tried.
I was along the right lines though and Rodolfo J. Paiz hit it right on the
head.
I think I'll just stick to reading instead of awnsering.
And BTW. I agree with the "FC2 Issues" thread.... Those kind of bugs should
NOT make it into a offical release that isn't an RC.
( alas, I too was bitten by the duel boot bug and so where quite a few
others that I know. )
-----Original Message-----
From: fedora-list-bounces(a)redhat.com
[mailto:fedora-list-bounces@redhat.com]On Behalf Of Alexander Dalloz
Sent: June 15, 2004 1:45 PM
To: For users of Fedora Core releases
Subject: Re: nat masquerade router
Am Di, den 15.06.2004 schrieb Michael Floyd um 19:29:
> Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not a 16
> bit ( 255.255.0.0 )
> It would be your firewall rules that are blocking you.....
Right.
> These two lines......
> # iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
> -d 192.168.0.0/16 -j ACCEPT
> # iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
>
> the ip's should be 192.168.1.0/24 not 192.168.0.0/16
> the way it's writen, you drop everthing on your subnet.
No :) That doesn't matter. 192.168.0.0/16 includes the 192.168.1.0/24
net. He is just bit more permissive than it needs. But does no harm.
What is causing the blocking is:
iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
It drops all incoming traffic not being from the private address range.
Thus packages from public internet are dropped.
What you intend is better placed to the INPUT chain.
> Michael Floyd
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) on Athlon CPU kernel 2.6.6-1.435
Serendipity 19:36:44 up 16:03, 8 users, 0.31, 0.29, 0.31
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
1:09 p.m.
By the way, my post assumes that eth0 is the public interface with
access to the internet and eth1 is the private network. Else switch
all occurence of eth0 to eth1 and vice versa.
On Tue, 15 Jun 2004 10:58:49 -0700, Erik Espinoza
<erik.espinoza(a)gmail.com> wrote:
This is how i do it on a box that has Taolinux, I imagine it would be
the same on Fedora:
## /etc/sysconfig/itpables
*nat
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
-A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# EOF
In addition I had to add the following into my /etc/sysctl.conf:
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
Try this configuration out, let me know if it works for you.
Erik
On Tue, 15 Jun 2004 13:54:02 -0400, Michael Floyd <michael.floyd(a)cgi.com> wrote:
>
> Well, at least I tried.
> I was along the right lines though and Rodolfo J. Paiz hit it right on the
> head.
> I think I'll just stick to reading instead of awnsering.
>
> And BTW. I agree with the "FC2 Issues" thread.... Those kind of bugs
should
> NOT make it into a offical release that isn't an RC.
> ( alas, I too was bitten by the duel boot bug and so where quite a few
> others that I know. )
>
>
>
> -----Original Message-----
> From: fedora-list-bounces(a)redhat.com
> [mailto:fedora-list-bounces@redhat.com]On Behalf Of Alexander Dalloz
> Sent: June 15, 2004 1:45 PM
> To: For users of Fedora Core releases
> Subject: Re: nat masquerade router
>
> Am Di, den 15.06.2004 schrieb Michael Floyd um 19:29:
>
> > Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not a 16
> > bit ( 255.255.0.0 )
> > It would be your firewall rules that are blocking you.....
>
> Right.
>
> > These two lines......
> > # iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
> > -d 192.168.0.0/16 -j ACCEPT
> > # iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
> >
> > the ip's should be 192.168.1.0/24 not 192.168.0.0/16
> > the way it's writen, you drop everthing on your subnet.
>
> No :) That doesn't matter. 192.168.0.0/16 includes the 192.168.1.0/24
> net. He is just bit more permissive than it needs. But does no harm.
>
> What is causing the blocking is:
>
> iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
>
> It drops all incoming traffic not being from the private address range.
> Thus packages from public internet are dropped.
>
> What you intend is better placed to the INPUT chain.
>
> > Michael Floyd
>
> Alexander
>
> --
> Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
> Fedora GNU/Linux Core 2 (Tettnang) on Athlon CPU kernel 2.6.6-1.435
> Serendipity 19:36:44 up 16:03, 8 users, 0.31, 0.29, 0.31
>
>
> --
> fedora-list mailing list
> fedora-list(a)redhat.com
> To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
>
1:13 p.m.
At 11:54 6/15/2004, Michael Floyd wrote:
I think I'll just stick to reading instead of awnsering.
No no no... do try! There is no better way to learn and truly master a
subject than by attempting to teach it.
Just qualify your post with something "not sure, but" or "could be wrong,
but" to indicate that you're not 100% sure you are providing a Solution
[tm], and take your best shot at anything. I promise that you will learn
more quickly than if you only read. And more and more over time, you *will*
succeed in helping people; besides which, the rest of us are happy that you
tried to help support a fellow member of the community.
Just trim your darn posts, man. <grin>
And BTW. I agree with the "FC2 Issues" thread.... Those kind
of bugs should
NOT make it into a offical release that isn't an RC.
( alas, I too was bitten by the duel boot bug and so where quite a few
others that I know. )
Suggestion: answer each thread with a few lines on what you think of *that*
thread. Anyone who's reading that other thread may never see your comments
here since they're not interested in someone else's iptables rules issues.
Cheers,
--
Rodolfo J. Paiz
rpaiz(a)simpaticus.com
http://www.simpaticus.com
1:06 p.m.
At 11:29 6/15/2004, Michael Floyd wrote:
Well I see that your using a 24 bit subnet mask ( 255.255.255.0 ) not
a 16
bit ( 255.255.0.0 )
It would be your firewall rules that are blocking you.....
These two lines......
# iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT# iptables -A FORWARD
-d 192.168.0.0/16 -j ACCEPT
# iptables -A FORWARD -s ! 192.168.0.0/16 -j DROP
the ip's should be 192.168.1.0/24 not 192.168.0.0/16
the way it's writen, you drop everthing on your subnet.
Maybe, but I don't think so... for two reasons:
1. The first rule that matches is applied. So his rule accepting
traffic from 192.168.0.0/16 (any IP in that range) comes before the rule
that drops all traffic not coming from that range.
2. Subnets for routing are one thing, but for firewalling the
netmask is used only to calculate the IP range involved. So 192.168.0.0/16
will effectively cover *every single address* in 192.168.XXX.YYY for any
valid values of XXX and YYY.
I may be wrong... but this is how I see it.
P.S. Michael, could you delete (trim) the portion of the previous message
not used in your response? It's really not nice to force the next guy
replying to clean up after you. Thanks!
Cheers,
--
Rodolfo J. Paiz
rpaiz(a)simpaticus.com
http://www.simpaticus.com
7279
days inactive
7279
days old
7 comments
5 participants
participants (5)
-
Alexander Dalloz -
c_r_＠fedora -
Erik Espinoza -
Michael Floyd -
Rodolfo J. Paiz