LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 10-03-2008, 11:26 AM   #1
landysaccount
Member
 
Registered: Sep 2008
Location: Dominican Republic
Distribution: Debian
Posts: 188

Rep: Reputation: 18
Help with packet forwarding


Hello.

I am trying to run a firewall to separate two lans, but can't get traffic forwarded from lan to lan. Here's part of the iptables:

I am using Lenny with the default kernel: 2.6.24-1-686

I have this set:
net.ipv4.conf.default.forwarding=1

EXT_IFACE="eth0"
LAN_IFACE="eth1"

EXT_IP="192.168.1.2"
LAN_IP="192.168.2.1"
UNIVERSE="0.0.0.0/0"

LAN_ADDRESSES="192.168.2.0/24"
LAN_NETWORK="192.168.2.0"

# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Forward from and to the LAN
iptables -A FORWARD -i $LAN_IFACE -o $EXT_IFACE -p tcp \
-s $LAN_ADDRESSES --sport $UNPRIVPORTS --dport 22 \
-m state --state NEW -j ACCEPT

This is the routing table:

Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 eth1
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0


That should be enough, I think, to forward from private lan to EXT. Do I need MASQ or what else?

Thanks.
 
Old 10-03-2008, 12:18 PM   #2
David1357
Senior Member
 
Registered: Aug 2007
Location: South Carolina, U.S.A.
Distribution: Ubuntu, Fedora Core, Red Hat, SUSE, Gentoo, DSL, coLinux, uClinux
Posts: 1,302
Blog Entries: 1

Rep: Reputation: 107Reputation: 107
Quote:
Originally Posted by landysaccount View Post
That should be enough, I think, to forward from private lan to EXT. Do I need MASQ or what else?
Here is a link to a NAT HOWTO that should help you figure out what you need to do next.
 
Old 10-03-2008, 08:30 PM   #3
landysaccount
Member
 
Registered: Sep 2008
Location: Dominican Republic
Distribution: Debian
Posts: 188

Original Poster
Rep: Reputation: 18
My confusion is if I really need to nat the traffic between the two lans. Would a simple FORWARDing work? I don't have any servers running that need to be accessed from the internet. Simple as:

internet ----------- router ------------ lan

Thanks.
 
Old 10-04-2008, 10:31 AM   #4
landysaccount
Member
 
Registered: Sep 2008
Location: Dominican Republic
Distribution: Debian
Posts: 188

Original Poster
Rep: Reputation: 18
Ok.

I finally got my script working by adding this:

iptables -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE

That was all I needed.

Thank you.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
IP packet forwarding chamithranaweera Linux - Networking 6 03-06-2007 03:09 AM
packet forwarding? one.eleven Linux - Networking 19 11-08-2006 03:35 AM
packet fragmentation in packet forwarding code cranium2004 Linux - Networking 0 05-16-2005 04:05 AM
Packet forwarding queries cranium2004 Linux - Networking 1 01-30-2005 11:30 AM
port forwarding and packet forwarding syrtsardo Linux - Newbie 2 07-03-2003 10:37 AM


All times are GMT -5. The time now is 09:37 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration