Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
There are less than 24 hours left to vote in the 2011 LinuxQuestions.org Members Choice Awards. Click here to go to the polls. Vote now and make sure your voice is heard!
I eventually came up with the following solution:
I installed firestarter and started to NAT trough the installation wizard that comes with firestarter. Strangely enough I had to point out a network interface for the internal network and the external network interface instead of IP range.
For this server I used 3 virtual networks,
on eth0 I used 192.168.0.1 in subnet 192.168.0.0/24
on eth0:0 I used 192.168.1.1 in subnet 192.168.1.0/24 and so on...
what I want now is to use nat to provide every node with nat but only the eth0 network had a connection.
does anyone know how to enable routing (nat) on all subnets or how to use the nat on subnet 192.168.0.0/24 for everyone?
because of security reasons I chose for multiple subnets, I preferably want to keep this function.
Keep in mind that unless your multiple subnets are on separate VLAN's or physical switches, any client who wants to communicate with the other subnet can just add another IP address to it's interface.
Install the package ipmasq in Debian, and read thru all documentation which is installed, run the installation script and ipmasq produces a nice package to start with.
Debian style is to use a script to configure iptables, so everytime you change this script, run it again and you have a whole freshly configured iptables. That is much better than using the built-in save and restore op iptables.
Open the script produced with the installer with you favorite editor, then define some different networks, like:
Code:
net_mared_internal=192.168.5.0/24
and then for each network, add a MASQUERADE rule and a FORWARD rule:
It shall be clear that net_mared is one of the subnets, nic_ext is the interface looking at internet, and nic_rnb is the internal network card. $IPTABLES is a variable holding the complete path to iptables, /sbin/iptables.
Keep in mind that unless your multiple subnets are on separate VLAN's or physical switches, any client who wants to communicate with the other subnet can just add another IP address to it's interface.
it doesn't have to be completely secure, I do not have switches that support vlans and it's mainly about preventing some less secured computers from doing damage to the important ones. it's probably way too advanced for the purpose but I just want to do it this way to learn something.
this does prevent most viruses from spreading to the important machines. I will post the outputs as soon as I get home.
I also already encountered the problem of not being able to adapt the firewall rules remotely (I do this trough the firestarter gui now)
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.1
88.159.xxx.xxx/23 dev eth1 proto kernel scope link src 88.159.206.149
default via 88.159.xxx.xxx dev eth1
default via 192.168.1.1 dev eth0 scope link src 192.168.1.1
default via 192.168.2.1 dev eth0 scope link src 192.168.2.1
default via 192.168.0.1 dev eth0 scope link
anyone has an idea what to do?
(enable routing for eth0:0 and eth0:1)
Last edited by Steviepower; 05-10-2010 at 04:20 PM.
Your iptables rules are masquerading all traffic going out eth1 which is good, however your forward chain is blocking all traffic not specifically allowed through.
Try that, if it does not work please repost the output of iptables-save after running the commands above.
You also have three default gateways setup, you should only have one. Assuming that the internet currently works from your main server, don't change that yet -- wait until everything else is fixed.
I ran the commands but still no go. I did discover something else...
I have been experimenting with one of the machines by putting it in different subnets (192.168.0.2 and 192.168.1.2) and if I put the machine on 192.168.0.2 I can connect to it using ssh and I can ping it (I also have an internet connection on the machine this way) but if I put the machine in the 192.168.1.2 network I can ping by ipaddress to 4.2.2.1(opendns or something like that) and to google, but I can't connect to it trough http.
so from the server to the client isn't possible, from the client to the server isn't possible (but ping works like a charm both ways!)
OK well I've found the problem!
Because I could ping everywhere I thought it was a firewall problem so I started to read documentation on iptables and I saw the following lines in the config:
Quote:
-A FORWARD -d 192.168.0.0/24 -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.0.0/24 -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
Because of this I executed the following commands:
Quote:
iptables -A FORWARD -d 192.168.1.0/24 -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.2.0/24 -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.2.0/24 -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
and now it works!
It's quite similar to what SuperJediWombat! said but this actually worked.
only thing left to do is to make them persistent.
Last edited by Steviepower; 05-11-2010 at 05:15 PM.
If those commands worked, mine should have. The only difference is that I allowed through all protocols, rather than just tcp and udp.
You should also need the rule accepting all forward traffic out of eth1. because when you initially ran iptables-save the only close rule was accepting all traffic in through eth0.
Can you post the output of these again, while it is working?
Code:
iptables-save
ifconfig
ip route
Last edited by SuperJediWombat!; 05-11-2010 at 08:30 PM.
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.1
88.159.x.x/23 dev eth1 proto kernel scope link src 88.159.x.x
default via 88.159.x.x dev eth1
default via 192.168.1.1 dev eth0 scope link src 192.168.1.1
default via 192.168.2.1 dev eth0 scope link src 192.168.2.1
default via 192.168.0.1 dev eth0 scope link
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
using NAT on multiple subnets.
