I am attempting to set up a Mandrake 9.1 to work as a router/firewall and am having some problems with it in the security routing area.
At least that's what I think?

It didn't like the IP address that I wanted to use so I went with its suggestion of 192.168.1.1 and reconfigured everything else on the network.

Also set the internet connections to use my ISP's DNS of 203.12.160.35 and 36 with a modem providing the connection.

The Mandrake PC will browse the net without a problem if I ping the gateway from a windows PC I get "destination host unreachable"

I have overcome this by setting the Drake Firewall to "Everything no fire wall"

But am still unable to get out to the internet from the windows PC.
The windows PC has the gateway set to 192.168.1.1 and the DNS settings to 203.12.160.35 and 36 and now sucessfully pings the gateway.


# route -n
executed on the gateway returns as the last line

Destination, Gateway, Genmask, Flags, UseIface,
0.0.0.0 203.29.131.72 0.0.0.0 UG ppp0

The gateway above 203.29.131.72 is the same as the remote address on the KPPP stastics for the modem.
So it should be able to find it's way out?
That is if it could get that far.

Is their a security setting I need?

You have to configure ip forwarding and ip masquerading. If you are using Mandrake, I suggest you use iptables. Review the documentation at www.netfilter.org.

oh man, dont forget this:

#echo 1 > /proc/sys/net/ipv4/ip_forward

that turns on ip forwarding. its off by default in RedHat, not sure what the default is in Mandrake but you can check it like this:

#cat /proc/sys/net/ipv4/ip_forward

if you get 0 then its off if you get 1 then its on. This goes in addition to setting up the iptables stuff.

Thanks guys.
I have grabbed a bunch of stuff from netfilter to read.

Ip forwarding should be disabled by default everywhere, based on the assuption that a typical PC will not have more than one network interface in it that needs to talk to the other interfaces.

Robert, (assuming RH) another option for a permanent firewall/router is to modify /etc/sysctl.conf and change
net.ipv4.ip_forward = 1
and do a /etc/rc.d/init.d/network restart
Something to consider...