DMZ cannot access internet

TheGNUbie · 11-25-2009, 09:39 PM

I recently changed my internet provider and wireless AP, now the DMZ cannot access the internet.

My Setup:
Wireless LAN - Wireless AP (D-Link Dir-655) - Linux Server - AT&T Modem - Internet

Everything worked properly before the setup and no changes have been made on the Linux Server/Firewall(shorewall).

My LAN can access the internet and the firewall but the firewall cannot access the internet. The only problem That I know of is that my LAN is on 192.168.0.* and the internal NIC of the Linux Server is 192.168.1.1 but since my LAN can access the internet (that goes through the Linux Server) it just seems odd why the server cannot.

Any suggestions you have is appreciated.

nimnull22 · 11-26-2009, 02:14 PM

Answer - you have too many NATs

archtoad6 · 11-29-2009, 09:36 AM

Quote:

Originally Posted by nimnull22

Answer - you have too many NATs

nimnull22, do you mean that you think double NAT-ing is causing the problem? -- Please explain why.

I have had a double NAT-ed, production, WiFi LAN in place for 6 months w/ no trouble.

TheGNUbie,

Where in the diagram is your DMZ?
1. Off the Linux Server/Firewall(shorewall)
2. Off the Wireless AP (D-Link Dir-655)?
3. Elsewhere?
What did you [have to] change when you made the ISP switch?
Who was your previous ISP?

nimnull22 · 11-29-2009, 10:39 AM

Ok, lets see.
1. Internet.
2. AT&T Modem - is it route, or router/switch, or bridge. How do you get IP from it? How many ports does it have?

TheGNUbie · 11-29-2009, 12:39 PM

@archtoad6,

1. Where in the diagram is your DMZ? ok I guess there isnt a DMZ
2. What did you [have to] change when you made the ISP switch? Almost nothing... once I got access to the internet, I just plugged the modem into the server, modified my interfaces file (see below) and it worked.

Code:

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address 192.168.1.1
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255


auto dsl-provider
iface dsl-provider inet ppp
pre-up /sbin/ifconfig eth1 up # line maintained by pppoeconf
provider dsl-provider

3. Who was your previous ISP? Local cable provider (outsourced from charter)

@nimnull22,
AT&T modem is a single port.
http://www.att.com/equipment/accesso...urer=&q_model=

Thanks guys.

nimnull22 · 11-29-2009, 12:56 PM

Quote:

Originally Posted by TheGNUbie

AT&T modem is a single port.
http://www.att.com/equipment/accesso...urer=&q_model=

Thanks guys.

So it is a bridge, but it understands LAN and its mask, so please log into it and check what LAN network is assigned.

And you did not answer: how does Linux Server get IP address?

archtoad6 · 11-29-2009, 02:39 PM

Quote:

Originally Posted by nimnull22

So it is a bridge, but it understands LAN and its mask, so please log into it and check what LAN network is assigned.

And you did not answer: how does Linux Server get IP address?

NO, it's NOT a bridge. It's a fairly std. aDSL modem w/ a built-in router, but no switch.

from http://www.att.com/equipment/accesso...rer=&q_model=:

Quote:

FEATURES
Single Ethernet port for simple DSL Internet connection. Fully supported by AT&T DSL Customer Support. This DSL Modem is currently designed for customers enjoying AT&T DSL in Arkansas, California, Connecticut, Illinois, Indiana, Kansas, Michigan, Missouri, Nevada, Ohio, Oklahoma, Texas, and Wisconsin. Please do not purchase if you are living in Alabama, Florida, Kentucky, Georgia, Louisiana, Mississippi, North Carolina, Tennessee, or South Carolina.
Item SKU: 2210-02-1022K(Motorola DSL Modem Model 2210)

TECHNICAL SPECS
LEDs: Power, Ethernet, DSL, Internet, and Activity Indicators
WAN Interface – ADSL (RJ-11)
ADSL Device configured for AT&T DSL services
8 Perm
ATM Adaptation Layer 5 (AAL5)
LAN Interface – Single Port Ethernet 10/100BASE-T Ethernet (RJ-45)

from http://www.dslreports.com/forum/r228...em-Model-2210:

Quote:

GTFan
Not for me in the 8 months I've had it. It might crap out eventually, but it's still going strong now. Has a decent router built in too, although you have to use telnet to access some of the common stuff, like DHCP reservations. Doesn't run hot either, but I think I got one of the later SNs with the chipset that doesn't have this problem.

The reference to DHCP explicitly answers where the LAN IP address assignments are, or should be, coming from (remember, this is AT&T we/he are dealing w/ here).

If it matters, the reference to Texas tells us that the WAN IP is obtained through PPPoE.

nimnull22 · 11-29-2009, 04:04 PM

Quote:

Originally Posted by TheGNUbie

...
Wireless LAN - Wireless AP (D-Link Dir-655) - Linux Server - AT&T Modem - Internet

My LAN can access the internet and the firewall but the firewall cannot access the internet.

How did you find that Server or/and Firewall can't access to internet?

archtoad6 · 11-29-2009, 04:07 PM

TheGNUbie,

I assume that the "Linux Server/Firewall(shorewall)" DID connect to the 'Net under your previous ISP?

Quote:

Local cable provider (outsourced from charter)

-- Please confirm, just for my peace of mind

.

Do you still have the old copy of the interfaces file you provided above? I suspect the changes to it may be the root of your problem.

BTW, If your LAN is connecting ok, what does it matter if the Firewall doesn't connect? Perhaps that's more secure.

OTOH, you may want to figure out what's going on. Consider my drawing of your networks:

Code:

             0       1    2          3    4   \   |   / 5
   (    )    +-------+    +----------+    +-------------+
  ( 'Net )===| modem |----| Firewall |----| Wireless AP |
   (    )    +-------+    +----------+    +-------------+
                                              | | | |  6

Each of the #'s, 1-6, represents a interface & it's IP address.

Code:

#  IP Address    Description
0  W.X.Y.Z       ISP provided via PPPoE

1  192.168.m.1   modem's LAN - gateway & DHCP server
2  192.168.m.q   modem provided via DHCP

3  192.168.1.1   Firewall's LAN - gateway, DHCP server off
4  192.168.1.s   static IP for Firewall's LAN

5  192.168.0.1   WiFi gateway & DHCP server
6  192.168.n.1   wired gateway & DHCP server

If you consider a "LAN" to be the hosts served by a DHCP server or any home subnet, then there are 4 "LAN's" here:

the modem's LAN -- consisting of it & the Firewall's WAN port,
the Firewall's LAN -- consisting of it & the DIR-655's WAN port,
the DIR-655's WiFi cloud,
the DIR-655's wired ports (4).

They may not be needed to solve your problem, but we still don't know the values of m, q, s, & n.

D-Link DIR-655 info.
http://www.dlink.com/products/?pid=530
http://i.i.com.com/cnwk.1d/sc/321450...overview-1.gif
http://i.i.com.com/cnwk.1d/sc/321450...40-front-2.gif
http://i.i.com.com/cnwk.1d/sc/32145084-2-440-side-3.gif
http://i.i.com.com/cnwk.1d/sc/32145084-2-440-back-4.gif
ftp://ftp10.dlink.com/pdfs/products/...DIR-655_ds.pdf

TheGNUbie · 11-29-2009, 05:25 PM

The WAN IP is obtained via PPPoE.
Eth0 192.168.1.1 static
Eth1 192.168.1.64 dynamic (I assume this is assigned by the modem and I have no idea how/if it can be configured)

I found out the server could not connect when trying to get updates, after that i tried to ping, telnet, or just access the web via browser.. none worked.

Yes the previous configuration (charter) did allow me to connect to the web, but eth1 was my external (internet) IP address.

The old interfaces file was exactaly the same except it did not have the following lines:

Quote:

auto dsl-provider
iface dsl-provider inet ppp
pre-up /sbin/ifconfig eth1 up # line maintained by pppoeconf
provider dsl-provider

If my firewall does not connect, how do I download updates? (I guess its fine if I cannot connect.. but not knowing why its not working is kinda bothering me)

if this diagram is correct:

Quote:

# IP Address Description
0 W.X.Y.Z ISP provided via PPPoE

1 192.168.m.1 modem's LAN - gateway & DHCP server
2 192.168.m.q modem provided via DHCP

3 192.168.1.1 Firewall's LAN - gateway, DHCP server off
4 192.168.1.s static IP for Firewall's LAN

5 192.168.0.1 WiFi gateway & DHCP server
6 192.168.n.1 wired gateway & DHCP server

The the problem could be that I have 2 IP addresses that are 192.168.1.1 (see below)
# IP Address Description
0 W.X.Y.Z ISP provided via PPPoE

1 192.168.m.1 modem's LAN - gateway & DHCP server
2 192.168.1.64 modem provided via DHCP

3 192.168.1.1 Firewall's LAN - gateway, DHCP server off
4 192.168.1.254 static IP for Firewall's LAN

5 192.168.0.1 WiFi gateway & DHCP server
6 192.168.n.1 Doesnt exist.

TheGNUbie · 11-29-2009, 05:45 PM

Thats did it! Thanks everyone.

archtoad6 · 11-30-2009, 02:47 AM

You're welcome, but what did you actually do to fix the problem?