Vault9 Modding Vault9 Graphics Vault9 Code Vault9 Net Vault9 OS Vault9 Gaming Vault9 ChillZone Vault9 Tech Vault9 Archives       Vault9 Global9       Vault9 Fusion     Vault9 Blog     Vault9 Network          
 
IPB

Welcome Guest ( Log In | Register )

Please Note!

This is a read-only board, no new topics or registrations are allowed. The OS Vault has moved to http://forums.vault9.net - Be sure to find more information there!


 
 Reply to this topicStart new topic
> Ip Masquerading and NAT problems, :( have a look.
Ravilj
post Jun 13 2005, 04:51 PM
Post #1


Dont fear the Penguins!
Group Icon

Group: Regular Member
Posts: 1,998
Joined: 3-November 03
From: South Africa, Johannesburg
Member No.: 2,166

Sex: Male
Ok I have got an old P1 with gentoo 2005.0 installed. I am trying to get the internet shared so that the rest of the clients can use it. The only service of interest will be the rp-pppoe that runs at startup to bring up the connection. All outputs are shown from the server, its hostname is o_O.

Here is the output of ifconfig to show the current config:
QUOTE
o_O init.d # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:08:A1:62:9A:F1
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10567 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7595 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:901621 (880.4 Kb)  TX bytes:1662568 (1.5 Mb)
          Interrupt:10 Base address:0xf800

eth1      Link encap:Ethernet  HWaddr 00:06:4F:13:B2:08
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4910 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4353 errors:0 dropped:0 overruns:0 carrier:0
          collisions:2 txqueuelen:1000
          RX bytes:4297824 (4.0 Mb)  TX bytes:356396 (348.0 Kb)
          Interrupt:5 Base address:0xf400

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
ppp0      Link encap:Point-to-Point Protocol
          inet addr:196.2.118.206  P-t-P:196.30.31.100  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1432  Metric:1
          RX packets:1943 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1700 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:1485225 (1.4 Mb)  TX bytes:112456 (109.8 Kb)

o_O init.d #

Where:
eth0 is the lan connection
eth1 connects to the iburst modem

I started off with a simple iptables script to just get nat working without any firewall action:
CODE
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Set up IP FORWARDing and MASQUERADING
iptables --table nat --append POSTROUTING --out-interface ppp0 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

Yes I know that there is quicker way of typeing it out but this is to make sure I can see clearly what is going on.

Now that you know what is going on here is the problem at hand.
- I can browse quite happily and ping sites on the server without a problem, the server gets the DNS info when logging on.
- I can ping websites quite happily from the client pc's, the clients have their DNS set to a DNS server that works (I use it when using the connection shared through windows sad.gif)
- I cant browse the web on the client pc's
- I cant connect to IRC on the client pc's, it identifies the servers but doesnt get any further.

Well I think I have covered just about all the information that I cant find.

Now for information on the iptables set:
QUOTE
o_O / # iptables -v -L
Chain INPUT (policy ACCEPT 14886 packets, 4826K bytes)
pkts bytes target    prot opt in    out    source              destination

Chain FORWARD (policy ACCEPT 859 packets, 131K bytes)
pkts bytes target    prot opt in    out    source              destination
  270 27023 ACCEPT    all  --  eth0  any    anywhere            anywhere

Chain OUTPUT (policy ACCEPT 11076 packets, 1735K bytes)
pkts bytes target    prot opt in    out    source              destination
o_O / #

and
QUOTE
o_O / # iptables -t nat -v -L
Chain PREROUTING (policy ACCEPT 996 packets, 67535 bytes)
pkts bytes target    prot opt in    out    source              destination

Chain POSTROUTING (policy ACCEPT 91 packets, 5295 bytes)
pkts bytes target    prot opt in    out    source              destination
  103  7639 MASQUERADE  all  --  any    ppp0    anywhere            anywhere

Chain OUTPUT (policy ACCEPT 35 packets, 2392 bytes)
pkts bytes target    prot opt in    out    source              destination
o_O / #


And lastely just incase you want to see what is compile in my kernel:
QUOTE
# Networking options
#
CONFIG_PACKET=y
CONFIG_PACKET_MMAP=y
# CONFIG_NETLINK_DEV is not set
CONFIG_UNIX=y
# CONFIG_NET_KEY is not set
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
# CONFIG_IP_ROUTE_MULTIPATH is not set
CONFIG_IP_ROUTE_VERBOSE=y
# CONFIG_IP_PNP is not set
# CONFIG_NET_IPIP is not set
# CONFIG_NET_IPGRE is not set
# CONFIG_IP_MROUTE is not set
# CONFIG_ARPD is not set
CONFIG_SYN_COOKIES=y
# CONFIG_INET_AH is not set
# CONFIG_INET_ESP is not set
# CONFIG_INET_IPCOMP is not set
CONFIG_INET_TUNNEL=y
CONFIG_IP_TCPDIAG=y
# CONFIG_IP_TCPDIAG_IPV6 is not set
#
# IP: Virtual Server Configuration
#
# CONFIG_IP_VS is not set
# CONFIG_IPV6 is not set
CONFIG_NETFILTER=y
# CONFIG_NETFILTER_DEBUG is not set

#
# IP: Netfilter Configuration
#
CONFIG_IP_NF_CONNTRACK=y
# CONFIG_IP_NF_CT_ACCT is not set
# CONFIG_IP_NF_CONNTRACK_MARK is not set
# CONFIG_IP_NF_CT_PROTO_SCTP is not set
CONFIG_IP_NF_FTP=y
CONFIG_IP_NF_IRC=y
# CONFIG_IP_NF_TFTP is not set
# CONFIG_IP_NF_AMANDA is not set
CONFIG_IP_NF_QUEUE=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_MATCH_LIMIT=y
CONFIG_IP_NF_MATCH_IPRANGE=y
CONFIG_IP_NF_MATCH_MAC=y
CONFIG_IP_NF_MATCH_PKTTYPE=y
CONFIG_IP_NF_MATCH_MARK=y
CONFIG_IP_NF_MATCH_MULTIPORT=y
CONFIG_IP_NF_MATCH_TOS=y
CONFIG_IP_NF_MATCH_RECENT=y
CONFIG_IP_NF_MATCH_ECN=y
CONFIG_IP_NF_MATCH_DSCP=y
CONFIG_IP_NF_MATCH_AH_ESP=y
CONFIG_IP_NF_MATCH_LENGTH=y
CONFIG_IP_NF_MATCH_TTL=y
CONFIG_IP_NF_MATCH_TCPMSS=y
CONFIG_IP_NF_MATCH_HELPER=y
CONFIG_IP_NF_MATCH_STATE=y
CONFIG_IP_NF_MATCH_CONNTRACK=y
CONFIG_IP_NF_MATCH_OWNER=y
CONFIG_IP_NF_MATCH_ADDRTYPE=y
# CONFIG_IP_NF_MATCH_REALM is not set
# CONFIG_IP_NF_MATCH_SCTP is not set
CONFIG_IP_NF_MATCH_COMMENT=y
# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_TARGET_REJECT=y
CONFIG_IP_NF_TARGET_LOG=y
CONFIG_IP_NF_TARGET_ULOG=y
CONFIG_IP_NF_TARGET_TCPMSS=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_NAT_NEEDED=y
CONFIG_IP_NF_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_REDIRECT=y
CONFIG_IP_NF_TARGET_NETMAP=y
CONFIG_IP_NF_TARGET_SAME=y
# CONFIG_IP_NF_NAT_SNMP_BASIC is not set
CONFIG_IP_NF_NAT_IRC=y
CONFIG_IP_NF_NAT_FTP=y
CONFIG_IP_NF_MANGLE=y
CONFIG_IP_NF_TARGET_TOS=y
CONFIG_IP_NF_TARGET_ECN=y
CONFIG_IP_NF_TARGET_DSCP=y
CONFIG_IP_NF_TARGET_MARK=y
CONFIG_IP_NF_TARGET_CLASSIFY=y
CONFIG_IP_NF_RAW=y
CONFIG_IP_NF_TARGET_NOTRACK=y
CONFIG_IP_NF_ARPTABLES=y
CONFIG_IP_NF_ARPFILTER=y
CONFIG_IP_NF_ARP_MANGLE=y
CONFIG_XFRM=y
# CONFIG_XFRM_USER is not set


This post has been edited by Ravilj: Jun 13 2005, 04:52 PM


--------------------
user posted image user posted image user posted image user posted image
User is offlineProfile CardPM
+Quote PostGo to the top of the page
Vault9
post Jun 13 2005, 04:51 PM
Post #


Member


Group: Administration

Joined: Today, 04:25 PM
Quote PostGo to the top of the page
SnaRf
post Jun 14 2005, 03:09 AM
Post #2


IReceiver Maker & Mod Maniac
Group Icon

Group: Regular Member
Posts: 1,115
Joined: 4-January 03
From: Johannesburg, South Africa
Member No.: 824

Sex: Male
QUOTE(Ravilj @ Jun 14 2005, 01:51 AM)
eth0 is the lan connection
eth1 connects to the iburst modem


1st question, WHY run ppp? you don't need it
2nd question, what's your default gateway set up to on the other 2 machines?
I am assuming it would be 192.168.0.1, and they all plug into the same switch as eth0?


If there is a specific reason to use the ppp interface, lemme know.

Otherwise, shall we continue assuming that you want internet bound traffic sent to eth1 on the "gateway" linux machine?

This post has been edited by SnaRf: Jun 14 2005, 03:09 AM


--------------------
Remote control your PC with ANY remote? <-- Click there
Need PC hardware? PM me!
User is offlineProfile CardPM
+Quote PostGo to the top of the page
Ravilj
post Jun 14 2005, 02:57 PM
Post #3


Dont fear the Penguins!
Group Icon

Group: Regular Member
Posts: 1,998
Joined: 3-November 03
From: South Africa, Johannesburg
Member No.: 2,166

Sex: Male
QUOTE
1st question, WHY run ppp? you don't need it

Erm ok how else do I connect? Any suggestions are welcome.

QUOTE
2nd question, what's your default gateway set up to on the other 2 machines? I am assuming it would be 192.168.0.1, and they all plug into the same switch as eth0?

You are correct, I actually have dnsmasq running as dns and dhcp server but that is currently disable for now, though it does work biggrin.gif

QUOTE
Otherwise, shall we continue assuming that you want internet bound traffic sent to eth1 on the "gateway" linux machine?

This would be true.

Someone enlightened me to the following:
http://redvip.homelinux.net/varios/2.4routing/x1807.html
http://redvip.homelinux.net/varios/2.4routing/x1834.html
http://www.e-infomax.com/ipmasq/howto/c-html/mtu-issues.html

So it would seem the fix (hack) is this
CODE
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
Which I will try tomorrow.

This post has been edited by Ravilj: Jun 14 2005, 03:03 PM
User is offlineProfile CardPM
+Quote PostGo to the top of the page
SnaRf
post Jun 14 2005, 11:38 PM
Post #4


IReceiver Maker & Mod Maniac
Group Icon

Group: Regular Member
Posts: 1,115
Joined: 4-January 03
From: Johannesburg, South Africa
Member No.: 824

Sex: Male
QUOTE(Ravilj @ Jun 14 2005, 11:57 PM)
Erm ok how else do I connect? Any suggestions are welcome.

I thought the Iburst modem is always on with an ethernet connection?!?!

SO, assuming it is:

You point eth1 of the gateway at the iburst modem, and set up your forwarding and natting that way...

p.s. I will read the above articles as soon as I can...
User is offlineProfile CardPM
+Quote PostGo to the top of the page
aquadog
post Jun 14 2005, 11:43 PM
Post #5


GO NINJA GO NINJA GO!
Group Icon

Group: Regular Member
Posts: 1,568
Joined: 11-November 02
From: Randburg, South Africa
Member No.: 720

Sex: Male
QUOTE(SnaRf @ Jun 15 2005, 08:38 AM)
QUOTE(Ravilj @ Jun 14 2005, 11:57 PM)
Erm ok how else do I connect? Any suggestions are welcome.

I thought the Iburst modem is always on with an ethernet connection?!?!
*



Nope, you still need to 'dial up' as with an adsl modem to initiate the connection. You do get adsl routers that do the dialing for you, yeah, but iBurst modems (and sentech) don't do it themselves.


--------------------
"I felt powerful for 5 minutes..."
User is offlineProfile CardPM
+Quote PostGo to the top of the page
SnaRf
post Jun 15 2005, 12:26 AM
Post #6


IReceiver Maker & Mod Maniac
Group Icon

Group: Regular Member
Posts: 1,115
Joined: 4-January 03
From: Johannesburg, South Africa
Member No.: 824

Sex: Male
oh.

My bad then sad.gif
User is offlineProfile CardPM
+Quote PostGo to the top of the page
Ravilj
post Jun 15 2005, 05:23 AM
Post #7


Dont fear the Penguins!
Group Icon

Group: Regular Member
Posts: 1,998
Joined: 3-November 03
From: South Africa, Johannesburg
Member No.: 2,166

Sex: Male
Got it working, read through the above links i pasted. Seems there is a problem with the mtu for the pppoe connection (mine is 1492) so larger packets get sent... yadda yadda yadda so one of the fixes is to limit the packet size using iptables which is all sorted.
User is offlineProfile CardPM
+Quote PostGo to the top of the page
nordic
post Jun 15 2005, 10:12 AM
Post #8


Illuminate
Group Icon

Group: Regular Member
Posts: 178
Joined: 26-April 02
From: Midhgardhr
Member No.: 144

Sex: Male
yeah thats true.... but thats only valid when dealing with faulty routers
user posted image
(the image is from http://renaud.waldura.com/doc/freebsd/pppoe/)
User is offlineProfile CardPM
+Quote PostGo to the top of the page
Ravilj
post Jun 15 2005, 04:32 PM
Post #9


Dont fear the Penguins!
Group Icon

Group: Regular Member
Posts: 1,998
Joined: 3-November 03
From: South Africa, Johannesburg
Member No.: 2,166

Sex: Male
Hmm so who is to blame? or more so what in my setup?
User is offlineProfile CardPM
+Quote PostGo to the top of the page
 

Reply to this topicStart new topic

Collapse

> Similar Topics

Topic Title Replies Topic Starter Views Last Action
Gentoo News->2008.0-r1 may help if you've had LiveCD problems 0 Vault9 481 Jul 8 2008, 12:37 AM
Last post by: Vault9
WINXP IRDA Problems 5 lord_moron 3,050 Oct 8 2006, 02:38 AM
Last post by: DieHard
WinXP Problems 1 PdT 1,657 Nov 11 2005, 06:12 AM
Last post by: PdT
log in problems 3 banku 1,036 Jul 3 2005, 09:47 AM
Last post by: noosh
Abit to replace boards with capacitor problems 0 MeTsU 392 Jun 27 2005, 01:39 AM
Last post by: MeTsU


 



- Lo-Fi Version Time is now: 13th March 2010 - 04:25 PM
Privacy Policy
South Africa's Top Sites Kinetiq
Invision Power Board v2.1.7 © 2010  IPS, Inc.
Licensed to: RKKi Industries