>This is not required. The default route will take care of this.
Thought so, but since it wasn't working....
>>When I set these rules, the fw can ping out but can't make any tcp
>>connections, and the web server gets "no route to host" if it tries to
>>ping out.
This was a brain fart on my part, the fw works fine all the time, it's the
server that craps out. Also, it doesn't get "no route to host" anymore,
but when I ping out from the server and then look at the kernel mesages
on the fw, it shows the return packets getting filtered. As long as I leave
forwarding to default accept and don't do a "catch all" at the end, it works
fine.
ifconfig on fw:
lo Link encap:Local Loopback
inet addr:127.0.0.1 Bcast:127.255.255.255 Mask:255.0.0.0
UP BROADCAST LOOPBACK RUNNING MTU:3584 Metric:1
RX packets:10 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
eth0 Link encap:Ethernet HWaddr 00:40:95:E0:20:33
inet addr:x.x.60.249 Bcast:x.x.60.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4121 errors:0 dropped:0 overruns:0 frame:6
TX packets:4626 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
Interrupt:15 Base address:0x300
eth1 Link encap:Ethernet HWaddr 00:40:95:E1:17:89
inet addr:172.23.1.250 Bcast:172.23.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
Interrupt:10 Base address:0x320
ppp0 Link encap:Point-to-Point Protocol
inet addr:x.x.60.250 P-t-P:x.x.51.14 Mask:255.255.255.0
UP POINTOPOINT RUNNING MTU:1600 Metric:1
RX packets:723 errors:0 dropped:0 overruns:0 frame:0
TX packets:903 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
Memory:16ea038-16eaccc
ifconfig on server:
lo Link encap:Local Loopback
inet addr:127.0.0.1 Bcast:127.255.255.255 Mask:255.0.0.0
UP BROADCAST LOOPBACK RUNNING MTU:3584 Metric:1
RX packets:7445 errors:0 dropped:0 overruns:0 frame:0
TX packets:7445 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
eth0 Link encap:Ethernet HWaddr 00:E0:7D:80:07:E9
inet addr:x.x.60.1 Bcast:x.x.60.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:400 errors:4 dropped:0 overruns:4 frame:0
TX packets:429 errors:2 dropped:0 overruns:0 carrier:4
Collisions:1
Interrupt:11 Base address:0x6800
eth0:0 Link encap:Ethernet HWaddr 00:E0:7D:80:07:E9
inet addr:x.x.60.3 Mask:255.255.255.0
UP RUNNING MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
eth1 Link encap:Ethernet HWaddr 00:E0:7D:80:10:2E
inet addr:172.23.1.1 Bcast:172.23.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:18 errors:1 dropped:0 overruns:1 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Collisions:0
Interrupt:10 Base address:0x6c00
netstat -rn on fw:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt
Iface
x.x.51.14 0.0.0.0 255.255.255.255 UH 1600 0 0
ppp0
x.x.60.0 0.0.0.0 255.255.255.0 U 1500 0
0 eth0
172.23.1.0 0.0.0.0 255.255.255.0 U 1500 0
0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 3584 0
0 lo
0.0.0.0 x.x.51.14 0.0.0.0 UG 1600 0
0 ppp0
netstat -rn on server:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt
Iface
x.x.60.0 0.0.0.0 255.255.255.0 U 1500 0
0 eth0
172.23.1.0 0.0.0.0 255.255.255.0 U 1500 0
0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 3584 0
0 lo
0.0.0.0 x.x.60.249 0.0.0.0 UG 1500 0
0 eth0
>a copy of your firewall rules
# for testing:
intnet="172.23.1.0"
intif="eth1"
extnet="x.x.60.0"
extif="eth1"
$universe="0.0.0.0"
ipfwadm -I -f
ipfwadm -O -f
ipfwadm -F -f
ipfwadm -I -p accept
ipfwadm -O -p accept
ipfwadm -F -f reject # This is what kills it
ipfwadm -F -a masquerade -W ppp0 -S $intnet -D $universe
# Here I have tried the rules which were in the last message, and I have
# tried forwarding dns, web, smtp, etc... to the server. Neither worked
>cat /proc/sys/net/ipv4/ip_forward
1
>Ps. Since you have your own Class-C network, I take it that your ISP
>has configured all the proper routing on their end to point
>your Class-C to your PPP address. No?
Yes, they have. Right now, I have it setup so that the fw is also the web,
dns, etc.. and it works fine, but I don't like those services running on the
fw, so I'm trying to switch it around. Not having much luck though.
Thanks,
John
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
