but the traffic coming in from eth2 to eth1 will have a source range of 192.168.170.x yes/no? Here's the routerbox firewall rules: echo " Flushing any pre-existing rules and setting default policy." $IPTABLES -t filter -F $IPTABLES -t nat -F $IPTABLES -t mangle -F echo " Setting Filter/Nat/Mangle Policies." $IPTABLES -t filter -P INPUT DROP $IPTABLES -t filter -P OUTPUT DROP $IPTABLES -t filter -P FORWARD DROP $IPTABLES -t nat -P PREROUTING ACCEPT $IPTABLES -t nat -P POSTROUTING ACCEPT $IPTABLES -t nat -P OUTPUT ACCEPT $IPTABLES -t mangle -P INPUT ACCEPT $IPTABLES -t mangle -P OUTPUT ACCEPT $IPTABLES -t mangle -P FORWARD ACCEPT $IPTABLES -t mangle -P PREROUTING ACCEPT $IPTABLES -t mangle -P POSTROUTING ACCEPT $IPTABLES -t nat -A PREROUTING -p tcp --dport 6346 -i ppp0 -j DNAT --to-destination 192.168.170.5 $IPTABLES -t nat -A PREROUTING -p udp --dport 6346 -i ppp0 -j DNAT --to-destination 192.168.170.5 echo " Filter Input Rules." $IPTABLES -t filter -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -t filter -A INPUT -i ppp0 -m state --state INVALID -j DROP $IPTABLES -t filter -A INPUT -i lo -j ACCEPT $IPTABLES -t filter -A INPUT -i eth1 -j ACCEPT $IPTABLES -t filter -A INPUT -i eth2 -j ACCEPT echo " Filter Output Rules." $IPTABLES -t filter -A OUTPUT -o ppp0 -j ACCEPT $IPTABLES -t filter -A OUTPUT -o ppp0 -m state --state INVALID -j DROP $IPTABLES -t filter -A OUTPUT -o lo -j ACCEPT $IPTABLES -t filter -A OUTPUT -o eth1 -j ACCEPT $IPTABLES -t filter -A OUTPUT -o eth2 -j ACCEPT echo " Filter Forward Rules." $IPTABLES -t filter -A FORWARD -i ppp0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -t filter -A FORWARD -i ppp0 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -t filter -A FORWARD -i ppp0 -o eth1 -m state --state INVALID -j DROP $IPTABLES -t filter -A FORWARD -i ppp0 -o eth2 -m state --state INVALID -j DROP $IPTABLES -t filter -A FORWARD -i eth1 -o ppp0 -j ACCEPT $IPTABLES -t filter -A FORWARD -i eth2 -o ppp0 -j ACCEPT $IPTABLES -t filter -A FORWARD -i eth1 --source 192.168.170.0/24 -j ACCEPT $IPTABLES -t filter -A FORWARD -i eth2 --source 192.168.169.0/24 -j ACCEPT #$IPTABLES -t filter -A FORWARD -o eth1 --source 192.168.170.0/24 -j ACCEPT #$IPTABLES -t filter -A FORWARD -o eth2 --source 192.168.170.0/24 -j ACCEPT echo " Enable SNAT MASQUERADE to Internet." $IPTABLES -t nat -A POSTROUTING -o ppp0 -j MASQUERADE echo " Now Go Ahead And Enable IP Forwarding." echo "1" > /proc/sys/net/ipv4/ip_forward On 5/26/05, Eduardo Spremolla <edspremolla@xxxxxxxxxxxx> wrote: > According to your routing table: > > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use Iface > 204.60.4.34 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 > 64.204.68.128 0.0.0.0 255.255.255.248 U 0 0 0 eth0 > 192.168.170.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 > 192.168.169.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 > 127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo > 0.0.0.0 204.60.4.34 0.0.0.0 UG 0 0 0 ppp0 > > the 170 subnet is atachet to eth2 and 169 onae to eth1. > > so $IPTABLES -t filter -A FORWARD -i eth1 --source 192.168.169.0/24 -j ACCEPT > > means accept traffic coming in from eth2 with source address in 192.168.169.x range. > > Are you sure not other firewall rule is dropping your pings. > > Go ahead and post the whole iptables-save output. > > LALO > > > On Thu, 2005-05-26 at 12:25 -0400, Mike wrote: > > Eduardo, > > > > Thank you for the reply. > > I'm wondering if your example should be reversed like this: > > > > $IPTABLES -t filter -A FORWARD -i eth2 --source 192.168.169.0/24 -j ACCEPT > > $IPTABLES -t filter -A FORWARD -i eth1 --source 192.168.170.0/24 -j ACCEPT > > > > Hmm, I've tried both ways, and something is still wrong. > > I can ping 192.168.170.5 ---> 192.168.169.1 > > But I cannot ping 192.168.170.5 ---> 192.168.169.2 (the Samba box, > > iptables off so no firewall issues). > > > > This is very strange. > > > > Please reply if you have a moment; I can post my whole iptables setup > > from the routerbox if that is helpful. > > > > Best regards, > > > > Mike > > > > On 5/26/05, Eduardo Spremolla <edspremolla@xxxxxxxxxxxx> wrote: > > > You need to allow forwarding in both directions: > > > $IPTABLES -t filter -A FORWARD -i eth1 --source 192.168.169.0/24 -j > > > ACCEPT > > > $IPTABLES -t filter -A FORWARD -i eth2 --source 192.168.170.0/24 -j > > > ACCEPT > > > > > > The prerouting Dnat is not required, be sure not to nat eth1 to eth2 > > > traffic. > > > > > > LALO > > > > > > On Wed, 2005-05-25 at 13:20 -0400, Mike wrote: > > > > I have a linux routerbox with 3 nics.: > > > > > > > > ppp0 goes to the internet service provider > > > > eth1 serves as gateway to a subnet > > > > eth2 serves as gateway to another subnet > > > > > > > > I want LAN clients from subnet eth2 to be able to access a Samba > > > > Server box located on subnet eth1 > > > > > > > > I have tried making a static route using --- route -n add > > > > <destination> <gateway> but all I get no matter what I try is: > > > > SIOCADDRT: No such device > > > > > > > > Here's my route -n > > > > > > > > Kernel IP routing table > > > > Destination Gateway Genmask Flags Metric Ref Use Iface > > > > 204.60.4.34 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 > > > > 64.204.68.128 0.0.0.0 255.255.255.248 U 0 0 0 eth0 > > > > 192.168.170.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 > > > > 192.168.169.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 > > > > 127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo > > > > 0.0.0.0 204.60.4.34 0.0.0.0 UG 0 0 0 ppp0 > > > > > > > > As a result of trying out a few extra iptables rules, I can now ping > > > > the eth1 gateway from the eth2 subnet clients, but I still cannot > > > > ping/reach the Samba server box on the eth1 subnet. > > > > > > > > Here's the rules I've added in hopes of making a proper path from > > > > subnet eth2 to eth1: > > > > > > > > $IPTABLES -t nat -A PREROUTING -p tcp -i eth1 --source > > > > 192.168.170.0/24 -j DNAT --to-destination 192.168.169.2 > > > > $IPTABLES -t nat -A PREROUTING -p udp -i eth1 --source > > > > 192.168.170.0/24 -j DNAT --to-destination 192.168.169.2 > > > > > > > > and > > > > > > > > $IPTABLES -t filter -A INPUT -i eth1 --source 192.168.170.0/24 -j ACCEPT > > > > > > > > and > > > > > > > > $IPTABLES -t filter -A FORWARD -i eth1 --source 192.168.170.0/24 -j ACCEPT > > > > > > > > Again, to be clear, clients on subnet eth2 can ping the gateway nic > > > > (eth1), but cannot ping the samba box located on subnet eth1. > > > > > > > > If I can just ping that box, I can config Samba the rest of the way. > > > > > > > > So I'm not sure if what I need for this is to create a static route, > > > > or whether iptables rules are all I need. > > > > > > > > Thank you for your time and patience in reading this post. > > > > > > > > Regards, > > > > > > > > Mike > > > > > > > > > > > > > Este e-mail y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. > > > . . . . . . . . . > > > This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender inmediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that not is the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy. > > > > > > Este e-mail y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. > . . . . . . . . . > This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender inmediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that not is the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy. >
