--- Jeff Vian <jvian10(a)charter.net> wrote:
On Wed, 2005-08-31 at 17:16 -0700, Antonio Olivares
wrote:
>
> --- Jeff Vian <jvian10(a)charter.net> wrote:
>
> > On Wed, 2005-08-31 at 12:20 -0700, Antonio
Olivares
> > wrote:
> > >
> > > --- Antonio Olivares <olivares14031(a)yahoo.com>
> > wrote:
> > >
> > > >
> > > >
> > > > --- Alexander Dalloz <ad+lists(a)uni-x.org>
wrote:
> > > >
> > > > > Am Di, den 30.08.2005 schrieb Antonio
Olivares
> > um
> > > > > 15:02:
> > > > >
> > > > > > > Make sure you have forwarding set on
on
> > the
> > > > > gateway
> > > > > > > host:
> > > > > > >
> > > > > > > $ cat /proc/sys/net/ipv4/ip_forward
> > > > > > >
> > > > > > > must print out "1" (without quotes).
If it
> > > > does
> > > > > not,
> > > > > > > then activate it in
> > > > > > > /etc/sysctl.conf and run "sysctl -p".
Make
> > too
> > > > > sure
> > > > > > > the gateway does NAT
> > > > > > > by an iptables rule like:
> > > > > > >
> > > > > > > iptables -A POSTROUTING -o eth0 -j
> > MASQUERADE
> > > > > > >
> > > > > > > [eth0 should be in your case the
outgoing
> > > > > device]
> > > > > >
> > > > > > eth0 is the incoming connection should
eth1
> > be
> > > > the
> > > > > > outgoing. I'm a little confused but
getting
> > > > > there.
> > > > >
> > > > > The device given with -o <device> has to
be
> > the
> > > > > public net device.
> > > > >
> > > > > > [root@rio ~]# cat
> > /proc/sys/net/ipv4/ip_forward
> > > > > > 1
> > > > >
> > > > > Ok.
> > > > >
> > > > > > [root@rio ~]# iptables -A POSTROUTING -o
> > eth0 -j
> > > > > > MASQUERADE
> > > > > > iptables: No chain/target/match by that
name
> > > > >
> > > > > Sorry, my fault. Above should have been
for
> > the
> > > > NAT
> > > > > table (by default
> > > > > iptables takes the filter table):
> > > > >
> > > >
> > > >
> > > === message truncated ===
> >
> > > I'm trying continually to solve this issue and
I
> > have
> > > tried with a windows2000 machine and I get
this
> > >
> >
> > Reading thru what you have below, this seems to
most
> > certainly be a
> > routing/firewalling/masquerading issue on the
linux
> > box.
> >
> > >From the windows box try this and let us know
the
> > results.
> > 1. ping 192.168.100.1
>
> [olivares@rio floppy]$ cat ping1
>
> Pinging 192.168.100.1 with 32 bytes of data:
>
> Reply from 192.168.100.1: bytes=32 time<10ms
TTL=64
> Reply from 192.168.100.1: bytes=32 time<10ms
TTL=64
> Reply from 192.168.100.1: bytes=32 time<10ms
TTL=64
> Reply from 192.168.100.1: bytes=32 time<10ms
TTL=64
>
> Ping statistics for 192.168.100.1:
> Packets: Sent = 4, Received = 4, Lost = 0 (0%
> loss),
> Approximate round trip times in milli-seconds:
> Minimum = 0ms, Maximum = 0ms, Average = 0ms
>
>
> > 2. ping 10.154.19.136
>
> [olivares@rio floppy]$ cat ping2
>
> Pinging 10.154.19.136 with 32 bytes of data:
>
> Reply from 10.154.19.136: bytes=32 time<10ms
TTL=64
> Reply from 10.154.19.136: bytes=32 time<10ms
TTL=64
> Reply from 10.154.19.136: bytes=32 time<10ms
TTL=64
> Reply from 10.154.19.136: bytes=32 time<10ms
TTL=64
>
> Ping statistics for 10.154.19.136:
> Packets: Sent = 4, Received = 4, Lost = 0 (0%
> loss),
> Approximate round trip times in milli-seconds:
> Minimum = 0ms, Maximum = 0ms, Average = 0ms
>
>
> >
> > 3. If both those work, then try a ping to
> > 10.154.19.130
>
> [olivares@rio floppy]$ cat ping3
>
> Pinging 10.154.19.130 with 32 bytes of data:
>
> Request timed out.
> Request timed out.
> Reply from 10.154.19.136: Destination host
> unreachable.
> Request timed out.
>
> Ping statistics for 10.154.19.130:
> Packets: Sent = 4, Received = 1, Lost = 3 (75%
> loss),
> Approximate round trip times in milli-seconds:
> Minimum = 0ms, Maximum = 0ms, Average = 0ms
> [olivares@rio floppy]$
>
Ok, this clearly shows that it is likely you are
having problems with
NAT (masquerading) &/or routing/firewalling. Your
windows machine can
connect to and see both interfaces on the Linux
server but cannot get
beyond that. I assume your Linux box has full access
to the internet
when I say this.
Check out the basic firewall rules for doing ip
forwarding and
masquerading. In your case eth1 is the LAN and eth0
is the WAN.
I do not have a basic setup available for FC
firewalling since my
firewall machine is running RH7.3 with ipchains and
FC uses iptables.
(My firewall machine is an old P3 with only 32mb
memory and cannot run
any version of FC.)
I will try to set up a list of rules that are basic
and will handle what
you need and send a sample to you. Others may beat
me to it, and
welcome if they do.
To see what you currently have as iptables rules,
try "iptables -L" and
send that.
Also send the contents of /etc/sysconfig/iptables
=== message truncated ===
[olivares@rio ~]$ iptables -L
bash: iptables: command not found
[olivares@rio ~]$ su -
Password:
[root@rio ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere
anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere
anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251
udp dpt:5353
ACCEPT udp -- anywhere anywhere
udp dpt:ipp
ACCEPT all -- anywhere anywhere
state RELATED,ESTABLISHED
REJECT all -- anywhere anywhere
reject-with icmp-host-prohibited
[root@rio ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.2.11 on Wed Aug 31
07:52:24 2005
*mangle
:PREROUTING ACCEPT [4991:3431359]
:INPUT ACCEPT [4887:3424427]
:FORWARD ACCEPT [96:6000]
:OUTPUT ACCEPT [4459:969407]
:POSTROUTING ACCEPT [4475:971455]
COMMIT
# Completed on Wed Aug 31 07:52:24 2005
# Generated by iptables-save v1.2.11 on Wed Aug 31
07:52:24 2005
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4467:969967]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any
-j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp
--dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state
RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with
icmp-host-prohibited
COMMIT
# Completed on Wed Aug 31 07:52:24 2005
# Generated by iptables-save v1.2.11 on Wed Aug 31
07:52:24 2005
*nat
:PREROUTING ACCEPT [759:76421]
:POSTROUTING ACCEPT [4:288]
:OUTPUT ACCEPT [394:23805]
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Wed Aug 31 07:52:24 2005
[root@rio ~]# cat /proc/sys/net/ipv4/ip_forward
1
[root@rio ~]#
Thanks for all your help and suggestions. It will
work. It is just a matter of finding where things are
stopping.
Best Regards,
Antonio
____________________________________________________
Start your day with Yahoo! - make it your home page
http://www.yahoo.com/r/hs