Howdy all: I've posted this message directly to David Ranch, but David -- if you see this one first, it has a bit more information at the tail-end.... I am experiencing what appear to be a routing and/or ipchains problem with the following configuration after upgrading the kernel on "Machine B" to 2.2.7. Previously this machine was on 2.0.36, as Machine A is still. Both were built using the SuSE 6.0 distribution. The reason for upgrading was to get port- forwarding support, after the necessary patches failed with SuSE's modified kernel 2.0.36 code, and the Linus' kernel code refused to compile with the egcs- 2.91.60 setup in the SuSE distro. The configuration was working well before these changes to Machine B. It could be a problem with my ipchains configuration, I have been using ipfwadm-wrapper without error messages, and am using ipmasqadm to enable portfw, also without error messages. As a total ipchains hatchling, I could be shooting myself in the foot in that area as well, particularly since -L listings seem to wait for a timeout between some records. I have commented these instances in the examples in the following section of configuration information: 205.192.144.109 <-- valid external IP address Machine A -- Linux 2.0.36 router masquerade to internal net 192.168.1.0 (and 192.168.2.0 on eth2) 192.168.1.1 | | <---- Nothing seems to get across here, either direction | 192.168.1.2 Machine B -- Linux 2.2.7 router masquerade to internal net 10.1.0.0 port forwarding tcp/udp port 25 only, using ipmasqadm 10.1.1.1 | | 10.1.1.10 LAN client (can get as far as 192.168.1.2, but times-out beyond) Masquerade on machine B is just to conceal internal traffic on the masq'd LAN from future connections to a 2nd card in the "A" machine. >From LAN workstation 10.1.1.10, I can successfully ping either interface on the "B" machine, but when I ping the dmz interface on the upstream router, all requests timeout. Meanwhile, at the masquerading machine, I enter ipfwadm - l -M (with ipfwadm-wrapper) which gives me the header, then a bit under three minutes later the line for the masquerading entry: prot expire source destination ports ICMP 00:59.51 10.1.1.10 inetrouter.mydom.net 512 (61004) -> 8 Information from the two routing/masquerading machines. Machine A routes: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 205.192.144.104 0.0.0.0 255.255.255.248 U 0 0 113 eth0 192.168.1.0 0.0.0.0 255.255.0.0 U 0 0 48 eth1 192.168.2.0 0.0.0.0 255.255.0.0 U 0 0 13 eth2 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 5 lo 0.0.0.0 205.192.144.105 0.0.0.0 UG 0 0 499 eth0 Machine B routes: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 Machine B ipchains -L (hostnames changed to ip addresses for continuity): Chain input (policy ACCEPT): target prot opt source destination ports ACCEPT all ---f-- anywhere anywhere n/a acctin all ------ anywhere anywhere n/a acctboth all ------ anywhere anywhere n/a inp all ------ anywhere anywhere n/a - all ------ anywhere 192.168.1.2 n/a - all ------ anywhere 10.1.1.1 n/a Chain forward (policy ACCEPT): target prot opt source destination ports ACCEPT all ---f-- anywhere anywhere n/a fwd all ------ anywhere anywhere n/a Chain output (policy ACCEPT): target prot opt source destination ports ACCEPT all ---f-- anywhere anywhere n/a acctout all ------ anywhere anywhere n/a acctboth all ------ anywhere anywhere n/a out all ------ anywhere anywhere n/a - all ------ 192.168.1.2 anywhere n/a - all ------ 10.1.1.1 anywhere n/a Chain acctin (1 references): Chain acctout (1 references): Chain acctboth (2 references): Chain inp (1 references): target prot opt source destination ports DENY all ----l- 10.1.0.0/16 10.1.0.0/16 n/a (at this point output hangs for several minutes after each record returned) DENY all ----l- 10.1.0.0/16 192.168.1.0/24 n/a DENY all ----l- 192.168.1.0/24 10.1.0.0/16 n/a DENY all ----l- 192.168.1.0/24 192.168.1.0/24 n/a DENY tcp ----l- anywhere 10.1.0.0/16 any -> tc3 DENY tcp ----l- anywhere 192.168.1.0/24 any -> tc3 DENY udp ----l- anywhere 10.1.0.0/16 any -> 1:3 DENY udp ----l- anywhere 192.168.1.0/24 any -> 1:3 Chain out (1 references): Chain fwd (1 references): target prot opt source destination ports MASQ all ------ 10.1.0.0/16 anywhere n/a Chain IpFwAdM! (0 references): target prot opt source destination ports - all ------ anywhere anywhere n/a - all ------ anywhere anywhere n/a I also see: ipmasqadm portfw -l -n prot localaddr rediraddr lport rport pcnt pref UDP 192.168.1.2 10.1.1.10 25 25 10 10 TCP 192.168.1.2 10.1.1.10 25 25 10 10 ...and netstat -tn Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 126 10.1.1.1:23 10.1.1.10:1033 ESTABLISHED :Tom Yamada [EMAIL PROTECTED] _______________________________________________ Masq maillist - [EMAIL PROTECTED] http://tiffany.indyramp.com/mailman/listinfo/masq Admin requests can be handled by web (above) or [EMAIL PROTECTED]
