| 1 |
Hans-Werner Hilse wrote: |
| 2 |
> Hi, |
| 3 |
> |
| 4 |
> On Tue, 16 Jan 2007 00:30:30 +0100 |
| 5 |
> "Daniel Pielmeier" <daniel.pielmeier@××××××××××.com> wrote: |
| 6 |
> |
| 7 |
> |
| 8 |
>>> - is forwarding actually really enabled? Just "cat" the |
| 9 |
>>> relevant /proc/sys/net/ipv4/ip_forward. |
| 10 |
>>> |
| 11 |
>> cat /proc/sys/net/ipv4/ip_forward |
| 12 |
>> returns 1 |
| 13 |
>> |
| 14 |
>> |
| 15 |
>>> So remaining things to check would be |
| 16 |
>>> - where do packets do what? Use "tcpdump" on the router to monitor |
| 17 |
>>> how packets flow. Don't cite all the output, but look at where |
| 18 |
>>> packets are coming and going. Two terminals with "tcpdump -i eth0" |
| 19 |
>>> and "tcpdump -i ppp0" would tell you that. Send a few pings from the |
| 20 |
>>> desktop to the internet. Also try pinging an IP from the desktop, not |
| 21 |
>>> just hostnames (to rule out nameserver borkage). |
| 22 |
>>> |
| 23 |
>> Here is what tcdump returns! |
| 24 |
>> [...] |
| 25 |
>> |
| 26 |
> |
| 27 |
> That's what I wanted to avoid with asking for not citing everything :-) |
| 28 |
> |
| 29 |
> But everything looks quite normal, except for that packets aren't |
| 30 |
> routed. So its up to somebody else to tell exactly what that "policy" |
| 31 |
> module in iptables does -- and how. I don't have answers left here -- |
| 32 |
> except for the case that a manual iptables setup is sufficient. |
| 33 |
> |
| 34 |
> Personally, I'm quite happy with |
| 35 |
> |
| 36 |
> $ iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE |
| 37 |
> $ iptables -A FORWARD -i eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT |
| 38 |
> $ iptables -A FORWARD -i ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT |
| 39 |
> |
| 40 |
> for the forwarding. All that fancy-schmanzy stuff that shorewall does |
| 41 |
> isn't in there, granted. |
| 42 |
> |
| 43 |
> -hwh |
| 44 |
> |
| 45 |
|
| 46 |
Well, I got lucky. I'm not real sure what I did to be honest. Here is |
| 47 |
my main box that is connected to the net: |
| 48 |
|
| 49 |
> root@smoker / # route |
| 50 |
> Kernel IP routing table |
| 51 |
> Destination Gateway Genmask Flags Metric Ref |
| 52 |
> Use Iface |
| 53 |
> nas2.greenwood1 * 255.255.255.255 UH 0 0 |
| 54 |
> 0 ppp0 |
| 55 |
> 192.168.0.0 * 255.255.255.0 U 0 0 |
| 56 |
> 0 eth0 |
| 57 |
> loopback * 255.0.0.0 U 0 0 0 lo |
| 58 |
> default nas2.greenwood1 0.0.0.0 UG 0 0 |
| 59 |
> 0 ppp0 |
| 60 |
> root@smoker / # |
| 61 |
|
| 62 |
> root@smoker / # iptables -L |
| 63 |
> Chain INPUT (policy ACCEPT) |
| 64 |
> target prot opt source destination |
| 65 |
> |
| 66 |
> Chain FORWARD (policy ACCEPT) |
| 67 |
> target prot opt source destination |
| 68 |
> |
| 69 |
> Chain OUTPUT (policy ACCEPT) |
| 70 |
> target prot opt source destination |
| 71 |
> root@smoker / # |
| 72 |
|
| 73 |
This is from the second rig: |
| 74 |
|
| 75 |
> swifty ~ # route |
| 76 |
> Kernel IP routing table |
| 77 |
> Destination Gateway Genmask Flags Metric Ref |
| 78 |
> Use Iface |
| 79 |
> 192.168.0.0 * 255.255.255.0 U 0 0 |
| 80 |
> 0 eth0 |
| 81 |
> loopback * 255.0.0.0 U 0 0 0 lo |
| 82 |
> default smoker 0.0.0.0 UG 0 0 |
| 83 |
> 0 eth0 |
| 84 |
> swifty ~ # |
| 85 |
|
| 86 |
No iptables on this one. I don't know what I did but it all works. I |
| 87 |
guess even I get lucky sometimes. :-O |
| 88 |
|
| 89 |
Dale |
| 90 |
|
| 91 |
:-) :-) :-) |
| 92 |
|
| 93 |
|
| 94 |
|
| 95 |
|
| 96 |
-- |
| 97 |
www.myspace.com/dalek1967 |
Archives