Hello,
I'm new to this list. I spent the last week reading docs and trying
various ideas, annoying my users at work in the process.
Our setup seems to be very common; I installed a firewall linux machine
(RH72 with a 2.4.17 kernel with the HTB patches applied)
This firewall has :
- eth0 as an internal LAN device, IP 192.168.1.254
- eth1 as the first external device, IP 192.168.254.253
connected to an ADSL cisco router (with int. IP 192.168.254.254)
- eth2 as the second external device
connected to a cable modem
getting it's IP information from DHCP, but according to the provider I
will always get the same address.
Now, I implemented stuff from the nano.txt document, and for outgoing
connections most things seem to work.
I set up /sbin/ifup-local to remove the default gateway route added by
dhcpcd so that after boot, the firewall machine at least works over the
ADSL connection.
Then I started writing the firewall script.
I start by applying the iptables rules for statefulness (are these
necessary ? exactly what do they do). I removed the interface
configuration commands, since that is handled by redhat.
Then I remove the default route, and add the three tables which together
implement the load balancing.
For outgoing connections, this mostly works : I can tell from traceroutes
that I get alternating outgoing gateways.
Now for the problems I'm having :
* before, when only using the ADSL as gateway, I could ssh to other boxes
on the internet without problems. With the new setup, when I ssh to one
of them (and the route goes over the second interface), the connection
hangs at the moment ssh starts up the X port forwarding. I suppose this
is because (IIRC) ssh tries to set up a connection from that box to my
current machine, which somehow fails. If the route happens to go over the
first interface, everything is ok.
* When trying to access the firewall from the outside, connections only
get established when coming in over the ADSL interface. When coming in
over the cable interface, the connection hangs, indicating the route back
is failing. This seems to me like another symptom of the same problem as
the other.
So here is a set of questions ;) You knew this was coming ...
a) nano.txt only mentions outgoing connections. Does this document apply
to incoming connections as well or not ? Should it work as outlined there,
should I infer different iptables and ip rules to handle incoming traffic,
or does it work in another way entirely ?
b) Since I don't have a default gateway and the gateway alternation works
on outgoing routes, I suppose that my gateway setup is correct. So the
fact that it cannot make incoming connections over eth2 is not due to eth1
being the default gateway as was the case before.
But what else could cause this behaviour ? Is it possible I might have my
SNAT/MASQUERADE set up wrong to get this effect ?
c) do I need to apply julian's patches in order for this basic setup
(incoming traffic on both interfaces) to work ? It is my understanding
from browsing through the archive that, for this basic functionality, it's
not necessary. I will of course apply these patches later on to have
gateway failure detection, but my question is if applying these patches
now or not will have any effect on my current setup.
Here is a list of output of various commands :
[root@columbus root]# ip rule
0: from all lookup local
50: from all lookup main
201: from 192.168.254.0/24 lookup 201
202: from 62.205.66.0/23 lookup 202
222: from all lookup 222
32766: from all lookup main
32767: from all lookup 253
[root@columbus root]# ip route list table main
192.168.4.0/24 dev eth0 proto kernel scope link src 192.168.4.254
192.168.1.0/24 dev eth0 scope link
192.168.254.0/24 dev eth1 proto kernel scope link src 192.168.254.253
62.205.66.0/23 dev eth2 proto kernel scope link src 62.205.66.243
127.0.0.0/8 dev lo scope link
(I have to note here that using redhat's network configuration initialized
the 192.168.254.0/24 to be "scope link" only, so no proto kernel and no
src addresss. I thought that this might have been wrong so I changed it
manually but it had no effect as far as I could tell)
[root@columbus root]# ip route list table 201
default via 192.168.254.254 dev eth1 proto static src 192.168.254.253
prohibit default proto static metric 1
[root@columbus root]# ip route list table 202
default via 62.205.67.254 dev eth2 proto static src 62.205.66.243
prohibit default proto static metric 1
default proto static
nexthop via 192.168.254.254 dev eth1 weight 1
nexthop via 62.205.67.254 dev eth2 weight 1
[root@columbus root]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
Chain keep_state (3 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
RETURN all -- anywhere anywhere
[root@columbus root]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
keep_state all -- anywhere anywhere
Chain keep_state (3 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
RETURN all -- anywhere anywhere
I hope this is enough information to help me debug the situation. Any
help is MUCH appreciated.
Thanks in advance,
Thomas
--
The Dave/Dina Project : future TV today ! - http://davedina.apestaart.org/
<-*- -*->
I should dress you up in pearl
Finest silk to touch your skin
Don't know how to write a love song
But don't leave
<-*- thomas@apestaart.org -*->
URGent, the best radio on the Internet - 24/7 ! - http://urgent.rug.ac.be/
