Re: updated iptables doesn't work with old rules

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Chinh and Rob,

Let me first thank you both very much for your help and explanation,
now everything works, routing was the problem as well as me not
understanding the iptables rules properly so was always setting
something not correct.


> >>DEVICE=eth1
> >>BOOTPROTO=none
> >>BROADCAST=192.168.10.255
> >>IPADDR=192.168.10.101
> >>NETMASK=255.255.255.0
> >>NETWORK=192.168.10.0
> >>ONBOOT=yes
> >>TYPE=Ethernet
> >>GATEWAY=192.168.10.254
> >
> >
> > This NIC seems to be connected to your hub/switch/machine B.
> > I'd say, because machine A -> internet works, put this one on the
> > 192.168.11.0/24 network and machine B also. (You don't want to change
> things
> > that are already working.)
> >
> > Change :
> > BROADCAST=192.168.11.255
> > IPADDR=192.168.11.1
> > NETWORK=192.168.11.0
> > GATEWAY=192.168.11.1


I changed this, now the internal net is on 192.168.11.0.


> >>DEVICE=eth0
> >>BROADCAST=192.168.10.255
> >>IPADDR=192.168.10.105
> >>NETMASK=255.255.255.0
> >>NETWORK=192.168.10.0
> >>TYPE=Ethernet
> >>ONBOOT=yes
> >>GATEWAY=192.168.10.254
> >
> >
> > Because you can use the internet on machine A, I suppose the config for
> eth0
> > is correct.


Indeed, I didn't change that and it's still working :)


> Daniel, you should try Rob's advice and see if you can get further. Here are
> some my two cents. I've never done a PPPoE/DSL in Linux but I noticed a few
> odd things about your configuration.
>
> >
> >>USERCTL=yes
> >>BOOTPROTO=dialup
> >>NAME=DSLppp0
> >>DEVICE=ppp0
> >>TYPE=xDSL
> >>ONBOOT=yes
> >>PIDFILE=/var/run/pppoe-adsl.pid
> >>FIREWALL=MASQUERADE
> >>PING=.
> >>PPPOE_TIMEOUT=80
> >>LCP_FAILURE=3
> >>LCP_INTERVAL=20
> >>CLAMPMSS=1412
> >>CONNECT_POLL=6
> >>CONNECT_TIMEOUT=60
> >>DEFROUTE=yes
> >>SYNCHRONOUS=no
> >>ETH=eth1
> >>PROVIDER=DSLppp0
> >>USER=02024784362
> >>PEERDNS=yes
> >>DEMAND=no
> >>PERSIST=no
>
> The line ETH=eth1 suggests to me that your PPP connection is bound to eth1.
> However, in your previous messages you state that eth1 is on the private
> side
> (attached to machine B) and eth0 is on the public side. This seems odd.


Now you've got me. To tell the truth in my first post I accidently
interchanged eth0 and eth1 so in all further posts I systematically
kept interchanging them in order not to mix up the conversation, so
whenever I was talking about eth1 I meant eth0 and vica versa, in
principle it's not a problem if it's systematic (this was not the real
problem as I kept track of the interchange). But as you correctly
point out in this above file, ifcfg-ppp0, I forgot to change it and
left the original in :)


> Additionally, resources on the net regarding PPP connections (usually bound
> to eth0) has a similar ppp0 configuration as yours. But the associated
> interface (usually eth0) for a ppp0 connection is usually down and not configured.
>
> DEVICE=eth0
> ONBOOT=no


Thanks for this as well, I changed it to ONBOOT=no.

At the moment my rules are:


echo 0 > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -t nat --flush
iptables --delete-chain
iptables -t nat --delete-chain
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -o eth0 -i ppp0 -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

which I understand are not secure or in any way optimal, but at least
they work, so I'll start adding the suggestions of both of you to make
them what they really supposed to be.

Thanks again very much!



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux