On 05/06/2012 06:57 PM, imnotpc wrote:
My thanks to you, Maarten, and Doug for replying. I knew that packets
in private subnets are never forwarded by routers, one of the basic
security features of the IPV4 system. I had never heard them referred
to as martian before, but the name makes sense. Based on the
destination of the packets (Google, Facebook), my assumption is that
these are not malicious, and based on my knowledge of my network, I
believe these are originating from the wireless hosts as Doug
indicated. I guess the only part I still don't understand is how these
packets are reaching the kernel of the gateway through NAT and
firewalls? Perhaps there is something I don't understand about how IP
traffic moves between hosts.
The basic idea of a gateway is that you have two NICs, one (say eth1)
connected to the same switch to which all your other wired hosts are
connected, and using an IP address of something internal, say
192.168.1.1. The other NIC (say eth0) is connected to your external
internet. Your routing table should indicate that any traffic for a
192.168.1.x address should go out eth1, and any traffic for something
other than 192,168.1.x should go out eth0. And you have NAT enabled for
anything going out eth0 so that your internal addresses get translated
to the external IP address assigned by your ISP as they pass through the
gateway.
This assumes that you're using a PC as a gateway. Your router should
play no part with the wired connections --- it and all the other wired
hosts should be plugged into the switch, i. e. you shouldn't be using
the inbound wired jacks on the router at all. The wireless goes into
the router, but beyond that plays on an equal level with the wired guys
all going into the gateway PC.
The problem you describe most likely results from trying to use the
router as the gateway in conjunction with the switch. You've got the
wired guys coming through the switch and participating in NAT and the
wireless guys coming into the router directly, and somehow bypassing NAT.
You mention the "gateway kernel", so I'm guessing that you are using a
gateway PC rather than a gateway router. If you are using a 192.168.3.x
subnet, then your gateway is NAT'ing some hosts and not others.
