Well, here's what I've got so far -- I didn't get any sleep last night and need to go fix that, but here's a few questions and assumptions:
SYN 192.168.10.3:2727 -> eth1[BOX3]eth2 -> eth1[BOX1]ppp0 NAT:62.234.0.234.61706 -> www.monkeynoodle.org:80 packet goes into BOX3 06:34:16.517303 192.168.10.3.2727 > 66.1.155.123.80: S 1254467949:1254467949(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) packet comes out of BOX3 06:34:16.517089 192.168.10.3.2727 > 66.1.155.123.80: S 1254467949:1254467949(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) packet goes into BOX1 and gets NAT'd ASSUMPTION -- BOX1's clock is 15 seconds fast. packet comes out of BOX1 06:34:31.223667 62.234.0.234.61706 > 66.1.155.123.80: S 1254467949:1254467949(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) 2/10ths of a second later... 192.168.10.3:2727 <- eth1[BOX3]eth2 <- eth1[BOX1]ppp0 NAT:62.234.0.234.61706 <- www.monkeynoodle.org:80 ACK packet goes into BOX1 and gets NAT'd 06:34:31.443667 66.1.155.123.80 > 62.234.0.234.61706: S 3199824407:3199824407(0) ack 1254467950 win 5840 <mss 1412,nop,nop,sackOK> (DF) the BOX3-eth2 trace never shows packets coming back from the Internet, only leaving. ASSUMPTION: packet goes into BOX3 packet comes out of BOX3 06:34:16.747496 66.1.155.123.80 > 192.168.10.3.2727: S 3199824407:3199824407(0) ack 1254467950 win 5840 <mss 1412,nop,nop,sackOK> (DF) I'll finish up tomorrow night, but BOX3 ETH2 is a place to start looking. Jack On Mon, 28 Jan 2002, Reginald R. Richardson wrote: > Ok Jack, talk to me know, have some info for you...i think we going to get it talk >now, i think i see the problem, but > the solution, i need you helping minds again... > > Attached you'll find tcpdump files of what's happening with these Routers overhere >in Europe.. > > My understanding of the DUMP, is not up to par, but according to me this is what i >see and assumed, but as always, u can > correct if i'm wrong.. > > Workstation 192.168.10.3 is sending his HTTP (80) traffic to his default router Box3 >(eth1) 192.168.10.254, and i can > clearly see him forward it according the the CABLE rule (fwmark2) to Box1 (eth), so >no problem there, after that short > journey, i see Box1 (eth1) forwards it to the Internet via ppp0, so everybody happy >there....... > > No the Internet "www.monkeynoodle.org" kindly accepts this request, and for some >reason or the other, decides to answer > to this poor request coming from europe......as i check again, i can see PPP0 >telling www.monkeynoodle.org, yes, yes..i > sent u a request...so gimme my reply, and he kindly answers that reply, and >forwards it to his next door neighbour > (box1 eth1), no he feels good, that he gets his reply back, and being a good guy, he >sends it back down the chain to > BOX3 eth2, > No box2 see this Port 80 packet coming in LOUD and clear...and kindly answers it >with joy, to forward it back to the > poor Workstation, that's waiting in vain for a reply, but eth2 has to send it via >his neighbour, which is BOX3 eth1, > which i can clearly see him doing..... > > But wait just one sec there..(Houston, i think we have a problem), yep....eth1 is >either refusing to answer, or he's > just not seeing this Port80 packet coming to him from eth1 ...TIMEOUT...RAIN >CHECK..... > > Now were here wondering WHAT the hell went wrong, is that, eth1 is angry with his >neighbour eth2 and refuse to answer, > or is it that he don't know the way back to send the packet back to the poor >workstation (192.168.10.3). > > Now, help us (me, myself and I) out there, what is missing here...well i think you >read my entire ip routes and ip > tables etc, so u have enough info to see whaz wrong, if any more info is needed >please let me know and i'll send it > live and direct to you... > > attached u'll find tcpdumps, and somekind of ASCII netdiagram of HomeNet in >Europe....struggling to offer Mommy, Daddy > and kids a descent internet connection.. > > BTW:i was looking at leaf for the ipcheck, but ain't find it...do u have a link for >me... > thnks for the help so far.. > > I think we going to get it work now.....but this is PHASE I, Phase II to follow, >that is PORT FORWARDING, had some > problems with it, but will check it out again, after we have this running like a >TRAIN > > Once again, thanks for your help and your ENERGY..... > I think i'll get this one working, i'm seeing the LIGHT, better than when i was >trying it with 1BOX, and two, external > interfaces... > > I HAVE A DREAM/HOPE, that it gonna work.. > > cheers > Reggie > > > On Sat, 26 Jan 2002 15:35:55 -0800 (PST), Jack Coates wrote: > >On Sat, 26 Jan 2002, Reginald R. Richardson wrote: > > > >> Jack../Charles > >> > >> we starting to see some light, but i guess that the lack of some > >>Linux Firewall > >> knowledge holding us back over here... > >> but here's what.. > >> > >> > >> On my BOX3 Non NAT/Firewall Box > >> if i add a default route on this box, via the CABLE Router (Box1), > >>then all > >> HTTP traffic goes out to the internet without a problem, and also, > >>all the > >> other traffic that has to go to the internet via Box2, goes to > >>Box2, so here i > >> can see that Box3, is sending the traffic to the correct InterNet > >>Router, so in > >> other words, he's a very nice Traffic Police, he's routing as > >>COMMANDED too.. > >> > >> For some reason, i can't figure out, why the return traffic is not > >>going back > >> to the workstation without any problem.. > >> > > > >To figure this out you need to use tcpdump; it's probably getting > >lost > >between box1 or 2 and box3. > > > >> but what i found strange, is that from the moment i say the the > >>default gateway > >> is box 1 eg. > >> > >> "ip route add 0/0 via 192.168.1.6" (box1), then i have no problem > >>internet > >> traffic proceeds, but from the moment i removed this route, no > >>more internet... > >> > >> to the little knowledge i have, i don't believe that BOX3 should > >>have an > >> default route, because i assume that the LOOKUP table is supposed > >>to tell him > >> where to send the data for the specific Traffice Type. (correct me > >>if i'm > >> wrong) > >> > > > >Maybe... a default route could be helpful if you get everything else > >configured right. > > > >> On Box1 and Box2, is the normal settings that came by > >>default..with Dachsten > >> onliest changes i have in those boxes is a static route back to the > >> 192.168.10.0 network, and i commented out the ipchains commands > >>that block > >> traffic to the 10.0.0.0 network on Box2 (see below) > >> > >> Box1 (Cable) > >> #ip route > >> 62.234.0.1 dev ppp0 proto kernel scope link src 62.234.0.234 > >> 192.168.1.4/30 dev eth1 proto kernel scope link src 192.168.1.6 > >> 192.168.10.0/24 via 192.168.1.5 dev eth1 > >> default via 62.234.0.1 dev ppp0 > >> > >> #ip addr sh > >> 7: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen > >>100 > >> link/ether 00:10:4b:bb:c8:25 brd ff:ff:ff:ff:ff:ff > >> 8: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc > >>pfifo_fast qlen 100 > >> link/ether 00:c0:f0:12:f1:c8 brd ff:ff:ff:ff:ff:ff > >> inet 192.168.1.6/30 brd 192.168.1.7 scope global eth1 > >> > >> Box2 (Adsl) > >> #ip route > >> 192.168.1.0/30 dev eth1 proto kernel scope link src 192.168.1.2 > >> 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.100 > >> 192.168.10.0/24 via 192.168.1.1 dev eth1 > >> default via 10.0.0.138 dev eth0 > >> > >> #ip addr sh > >> 7: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen > >>100 > >> link/ether 08:00:00:22:20:34 brd ff:ff:ff:ff:ff:ff > >> inet 10.0.0.100/24 brd 10.0.0.255 scope global eth0 > >> 8: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc > >>pfifo_fast qlen 100 > >> link/ether 00:40:05:27:cb:9a brd ff:ff:ff:ff:ff:ff > >> > >> This is a little tricky one, cause my ADSL provider Network > >>requires us to > >> create a VPN connection between my router and the ADSL MODEM, so > >>therefore the > >> default route is the ADSL Modem 10.0.0.138 (before u asked, i > >>commented out the > >> IPCHAINS rules in this router that block the RFC ip's of 10.0.0.0) > >> > >> >From this router i can ping the internet without any problem, so > >>therefore i > >> have internet connectivity. > >> > >> Here is what i have on Box3 > >> #ip addr sh > >> 7: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen > >>100 > >> link/ether 00:10:4b:bb:c8:25 brd ff:ff:ff:ff:ff:ff > >> 8: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc > >>pfifo_fast qlen 100 > >> link/ether 00:c0:f0:12:f1:c8 brd ff:ff:ff:ff:ff:ff > >> inet 192.168.1.6/30 brd 192.168.1.7 scope global eth1 > >> > >> > >> # ip ru ls > >> 0: from all lookup local > >> 32764: from all fwmark 1 lookup adsl > >> 32765: from all fwmark 2 lookup cable > >> 32766: from all lookup main > >> 32767: from all lookup default > >> > >> > >> # ipchains > >> Chain input (policy ACCEPT: 100740 packets, 8739050 bytes): > >> prot opt tosa tosx ifname mark outsize source destination > >> ports > >> tcp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 80 > >> udp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 80 > >> udp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 443 > >> tcp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 443 > >> tcp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 110 > >> tcp ------ 0xFF 0x00 * 0x2 192.168.10.0/24 0.0.0.0/0 * > >> -> 25 > >> tcp ------ 0xFF 0x00 * 0x1 192.168.10.0/24 0.0.0.0/0 * > >> -> 1214 > >> Chain forward (policy ACCEPT: 75921 packets, 6589166 bytes): > >> Chain output (policy ACCEPT: 95403 packets, 8331173 bytes): > >> > >> # ip ro ls table cable > >> default via 192.168.1.6 dev eth2 > >> > >> # ip rou ls table adsl > >> default via 192.168.1.2 dev eth0 > >> > >> # ip route > >> 192.168.1.0/30 dev eth0 proto kernel scope link src 192.168.1.1 > >> 192.168.1.4/30 dev eth2 proto kernel scope link src 192.168.1.5 > >> 192.168.10.0/24 dev eth1 proto kernel scope link src > >>192.168.10.254 > >> > > > >Looks alright from a cursory glance, tcpdump is the only way to tell > >if > >it's really working like you expect. > > > >> > >> Jack, > >> What did u mean with this comment, don't under what u mean with > >>"tc" > >> "Make sure you have proper tc rules for _both_ directions" > >> > > > >Sorry, I meant fwmark rules; tc is a tool from the same iproute2 > >suite > >used for QoS. > > > >> Do hope i have provided enough information, so that i can get > >>these babies talk > >> to me, and do what they should do. > >> > >> Can some one give me a tip, on what i can do to tell BOX3 that if > >>he routes > >> HTTP traffic to BOX1, and there is no reply, then he should send > >>it to Box2 > >> > > > >First concentrate on getting fwmark to work, then worry about > >failover > >:-) To do this you'll just find the ipcheck script from the LEAF site > >and modify it to your needs. > > > >> thnks alot > >> > >> On Sat, 26 Jan 2002 08:26:44 -0800 (PST), Jack Coates wrote: > >> >Been there done that :-) Make sure you have proper tc rules for > >> >_both_ > >> >directions, and try tcpdump on all three boxes. Not sure if you > >> >already > >> >knew this, but tcpdump has a ton of command line options to make > >>it > >> >just > >> >show the packets you're looking for. Also double-check your NAT > >>and > >> >the > >> >routing on box 1 and 2. I suspect something like this is > >>happening to > >> >you: > >> > > >> >z.z.z.z:1024 SYN -> box3 -> box1(NATSRC=x.x.x.x:4001) -> > >>a.a.a.a:80 > >> > > >> >z.z.z.z:1024 box3 <ACK loops back to> box1 <- > >>a.a.a.a:80 > >> > > >> >So on each box get two consoles (one for eth0 and one for eth1), > >> >then do > >> >a: > >> >tcpdump -i eth[0|1] -n port 80 and host 66.1.155.123 > >> > > >> >and then go to your client workstation and browse to > >> >www.monkeynoodle.org. The tcpdump output should make it very clear > >> >what > >> >happened. > >> > > >> >Good luck! > >> >Jack > >> > > >> >On Sat, 26 Jan 2002, Reginald R. Richardson wrote: > >> > > >> >> Me again.. > >> >> > >> >> We getting there, with this 3 router box... > >> >> > >> >> Question: > >> >> I reach so far as having Router3 sending the HTTP traffic to the > >> >>correct > >> >> router, the SMTP traffic to the correct box also, as i use my > >> >>TCPDUMP on my BOX > >> >> connecected to the Internet, i can see the HTTP traffic being > >> >>transmitted to > >> >> the internet, but my problem is it's not being return to the > >> >>requesting > >> >> workstation. > >> >> > >> >> this is what my HTTP lookup table looks like > >> >> ip rout ls table http > >> >> default dev eth2 scope link > >> >> > >> >> I must say, that if i clear this table, and let BOX3, with a > >> >>DEFAULT GW to the > >> >> internet via BOX1 or BOX2, then the Workstation can connect to > >>the > >> >>net without > >> >> any problems. > >> >> > >> >> I don't have the slightest idea now where i should look > >> >> > >> >> thnks > >> >> > >> >> On Wed, 23 Jan 2002 14:14:37 -0600, Charles Steinkuehler wrote: > >> >> >Everything seems to be moving like a charm, not getting the IP > >> >>ROUTE > >> >> >per TCP > >> >> >Port talking to healthy, but still working on it.. > >> >> > > >> >> >question. > >> >> >U mentioned why not use "equal-weight routing", i checked at > >> >>googles > >> >> >to get > >> >> >more info about this, it seems a nice way to go...but can u > >>guide > >> >>me > >> >> >to a > >> >> >weblink where i can find more info on how to implement this on > >>my > >> >> >Box3, > >> >> > > >> >> >CS> Start with the Advanced Routing HOWTO, from linuxdoc.org or > >> >> >similar...if > >> >> >you get your port-based routing tables setup, you'll be over > >>most > >> >>of > >> >> >the > >> >> >hurdles... > >> >> > > >> >> >CS> Keep us all posted on your progress...if you get this > >> >>working, > >> >> >it's the > >> >> >first step to doing the same thing cleanly with a single box. > >> >> > > >> >> >Charles Steinkuehler > >> >> >http://lrp.steinkuehler.net > >> >> >http://c0wz.steinkuehler.net (lrp.c0wz.com mirror) > >> >> > > >> >> > > >> >> > >> >> > >> >> > >> >> > >> >> ------------------------------------------------------------- > >> >> Reginald R. Richardson > >> >> [EMAIL PROTECTED] on 1/26/2002 > >> >> > >> >> > >> >> > >> >> _______________________________________________ > >> >> Leaf-user mailing list > >> >> [EMAIL PROTECTED] > >> >> https://lists.sourceforge.net/lists/listinfo/leaf-user > >> >> > >> > > >> > >> > >> > >> > >> ------------------------------------------------------------- > >> Reginald R. Richardson > >> [EMAIL PROTECTED] on 1/26/2002 > >> > >> > > > > > > > ------------------------------------------------------------- > Reginald R. Richardson > [EMAIL PROTECTED] on 1/28/2002 > -- Jack Coates Monkeynoodle: A Scientific Venture... _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
