LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 06-20-2011, 01:33 AM   #1
slugman
Member
 
Registered: Jun 2010
Location: Los Estados No Estan Unidos
Distribution: Slackware
Posts: 58

Rep: Reputation: 1
Slackware router: lan eth1 works, lan eth2 doesnt! Iptables config issue


Hey whats up fellow LQ readers!

This weekend I finally gathered the courage to create my very own router, from scratch. I installed Slack 13.37_x86 on my roomates Dell P4. After doing my research from posts here on LQ, and a couple others on the web, I was able to get my router mostly working!

My problem is: my router has 2 lan facing ethernet interfaces, however I can only get 1 lan interface to work at a time. The interface can assign dhcp leases no problem, but I can't connect to anything through this interface. Upon further inspection, I realized I cannot ping anything behind this interface either--including the gateway!

I am using dhcpd to serve dhcp, and iptables to enable nat. I pretty much based my dhcpd.conf file from alien-bob's guide on a pxe-server setup.

My dhcpd server is working just fine (verified on my other slack boxes, and my roomates Win7 box). After performing some troubleshooting, I noticed that my lan interface works depending on the order of my lan facing interfaces in my iptables script. The following is a copy of my script:

(I know, its a bit weird but for whatever reason udev wanted to make the integrated nic eth1, and my gigabit nics eth0 and eth2.)

Code:
#
# iptables script
#
# This script will enable iptables settings for our router
# 
# Notes: 
# WAN interface: eth1
# Lan interface: eth0, eth2
#
# Last Modified: 061811

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Enable IP Masquerading

iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT
iptables --append FORWARD --in-interface eth2 -j ACCEPT
My big problem is the last line of my script! Systems connected to eth0 will work, but eth2 doesn't. If I switch the order of the interfaces in my script, eth2 will work but eth0 won't. This verifies that this is a) an iptables configuration issue, and b) my hardware is working correctly.

Whichever --in-interface is listed 2nd is the one which bites the dust. Like I mentioned above, this interface can assign dhcp lease information no problem, but I can't ping anything through the interface, not even the gateway! (My dhcpd.conf file lists both of my lan interfaces as a gateway, 172.16.0.2, and 172.16.0.1. The latter takes precedence in dhcpd.conf).

I would be most grateful for any advice anyone is willing to offer. If there are any network admin's, iptables gurus, or *nix junkies who happen chance upon this thread, your advice will be most greatly appreciated!

These problems aside, this is a bad ass solution for a router. I know my current iptables script pretty much leaves my box wide open--I intend to fix this once I get a better grip on iptables configuration. My router also serves as my tftp/bootp server. I'm sure there's some readers out here who would like to get started on this project on their own. I intend to share my experiences in the form of a guide in a thread--as soon as I can figure this out!

Last edited by slugman; 06-20-2011 at 04:09 AM. Reason: clarification
 
Old 06-20-2011, 02:38 PM   #2
slugman
Member
 
Registered: Jun 2010
Location: Los Estados No Estan Unidos
Distribution: Slackware
Posts: 58

Original Poster
Rep: Reputation: 1
you know, I was just thinking.. I believe the solution to my problem is to bridge eth0 & eth2. I just realized this when I was discussing my router with one of my colleagues here at my lab. I'll give this a go once I'm home and report my results.
 
Old 06-21-2011, 01:37 AM   #3
slugman
Member
 
Registered: Jun 2010
Location: Los Estados No Estan Unidos
Distribution: Slackware
Posts: 58

Original Poster
Rep: Reputation: 1
Thumbs up hooray, physdev here we come

hey chums thanks for all the help--I finally figured it out! I admit it took some reading, but I was finally able to break it down.

So, turns out a bridge is exactly what I needed. (I should have mentioned, my goals was to render both lan facing ethernet interfaces a 'ethernet-switch'.) However, my iptables script didn't quite work right away. After reading up the man pages, I discovered that bridge's require you to use the physdev module. I'm by no means a iptables expert yet--blatantly obvious by the wide gaping whole port scanners and bot spammers alike will no doubt be barging through (i'm refering to my iptables config of course). Networking is not my strong suite by a longshot, but I'm hoping some weekend tinkering and a few bowls of kind will help fix that.

So, first I create bridge interface:

Code:
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth2
Make sure both eth0 and eth2 are set to 0.0.0.0 (via ifconfig), then enable br0 as gateway via ifconfig:

Code:
ifconfig br0 up; ifconfig br0 172.16.0.1
.. and finally, the money maker (the big enchilada folks):

Code:
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables -A FORWARD -m physdev --physdev-in eth2 -j ACCEPT
iptables -A FORWARD -m physdev --physdev-in eth0 -j ACCEPT
I'll put up a guide sometime during the week when I have some free time. Now I'm off to download the interwebs --happy slacking!
 
  


Reply

Tags
dhcpd, iptables, nat, router, slackware


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
CentOS 5.2: Only one of eth0 (internet) or eth1 (LAN) works Sinedie Linux - Networking 3 08-20-2008 04:52 AM
Server access issue - works from internet but not the lan kevinyeandel Linux - Networking 2 06-09-2008 08:49 AM
Router doesnt show lan clients Person_1873 Linux - Networking 2 01-13-2008 06:18 AM
router pc problem, internet stopped working, lan works, using rc.firewall glorsplitz Linux - Networking 4 10-09-2007 07:18 PM
can't connect via ftp on my lan....this is my iptables config.... loboautoma Linux - Security 8 01-28-2005 01:14 AM


All times are GMT -5. The time now is 09:45 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration