Community:[details deleted]
I am a Linux noob who has installed Linux firewall 2.2.19-3-LEAF via floppy on a P120, and setup as a firewall. I have it successfully routing to my WinMe machine. The WinMe machine is also on a separate home internal network (eg., 2 networks, 192.168.0.x and 192.168.1.x), and has Internet Connection Sharing for 4 other Win machines, including an XP system (don't ask, lol). All machines are able to connect thru the Dachstein fw to the internet, but only I have access (both physical via an ethernet hub between the fw and the WinMe machine, and also via ssh).
I am now attempting to add another p120 that I have already connected to my internal network but because it is running redhat, I cannot use the WinMe's ICS capabilities, and thought it would be easier to connect the redhat machine also to the fw network (192.168.1.200) statically. I am able to ping back and forth successfully between the fw and the redhat box by IP (cable running from the redhat box to the same ethernet hub that is between the WinMe machine and the firewall). However, I cannot ping back and forth by name from the fw side, and am further unable to ping to the internet past the fw, either by name or IP, from the redhat side.
The Windows part of this setup sounds a bit unconventional, but since that should not affect the interaction between the RH host and the Dach host, we'll put it aside for the moment.
Some of the problems you report are DNS related; the RH host simply cannot resolve either LAN or Internet names to IP addresses. To troubleshoot this, we need to know
1. How the RH host is supposed to do on-LAN DNS (actualyl, on this small a LAN, use of /etc/hosts, not DNS, would be the natual choice).
2. How the RH host is supposed to do Internet DNS (in practice, this means seeing the contents of /etc/resolv.conf). Since you cannot ping the Internet by address either, it may be that you simply cannot reach off-LAN nameservers to do DNS.
As to actual connectivity ... connectivity on the LAN appears to be complete ... the fDach and the RH hosts can ping successfully fine by address. The inability of the RH host to ping to the Internet by address could be any of several things, but the likely starting point is the routing table on the RH host. You need to confirm that the Dach firewall's LAN IP address (192.168.1.254) is the RH host's default gateway. You can do that in any of several ways, epending on exactly what is installed on the RH system; one fairly standard choice is to check the output of "netstat -nr" for a line similar to this one:
0.0.0.0 192.168.1.254 0.0.0.0 UG 40 0 0 eth0
If you don't have this entry, you need to add it using whatever approach your RH host uses to configure networking. There are several to choose from; one is with a configuration file called /etc/network/interfaces, used in conjunction with the apps "ipup" and "ipdown" ... but your system may use a different approach.
If it's not a problem with the routing table, the next place to check is firewall rulesets. You posted the one for the Dach router, and it looks fine (it's not a complex ruleset to check by eye, once you have a bit of practice) ... but the RH host may itself have an on-host firewall present. Check with one of these commands:
ipchains -nvL (for 2.2.x kernels)
iptables -nvL (for 2.4.x kernels)If none of that hits the problem, then I'm stumped. At that point, I would suggest you confirm that the WinME host can use this connection, that its dual-homed nature is not conealing a greater problem than you realize you have. Also verify that the Dach router itself can ping Internet addresses.
BTW, the long posting was not "overkill". It was providing adequate detail to let me eliminate the router itself as a source of the problem. Troubleshooting usually is about details. Fr example, when you write ...
I'm unclear as to how I would add the needed route to the redhat box:
firewall: -root- # ip route show 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.254 24.218.201.0/24 dev eth0 proto kernel scope link src 24.218.201.135 default via 24.218.201.1 dev eth0
... reading this output of the routing table says the firewall already has the needed route (since the RH host is on network 192,.168.1.0/24).
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
