LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-14-2012, 04:51 PM   #16
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,604

Rep: Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241

One thing about that "net.ipv4.ip_forward=1" - it applies to routable IPv4 networks. The two networks you are using are members of "192.168.xx.xx" networks, and these are NOT routable.

You CAN use iptables to route these, but it is usually (not always) done as part of NAT. NAT makes this easier in one direction (from "behind the NAT" to outside) but this imposes a NAT behind a NAT type of thing - doable, but a pain as it doesn't allow the middle network to access behind the lower level NAT.

And no, I haven't done such routing without using masquerading.
 
Old 12-15-2012, 01:47 AM   #17
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 595

Original Poster
Rep: Reputation: 34
Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.


Thanks and Best Regards
 
Old 12-15-2012, 04:34 AM   #18
markush
Senior Member
 
Registered: Apr 2007
Location: Germany
Distribution: Slackware
Posts: 3,979

Rep: Reputation: 850Reputation: 850Reputation: 850Reputation: 850Reputation: 850Reputation: 850Reputation: 850
You will need to configure iptables because you'll have to tell the router where the packages should go. Also you need NAT.

You should read more about iptables and understand that it is not only "the firewall" but also manages routing, or in other words, a firewall is nothing but "routingrules".

Markus
 
Old 12-15-2012, 06:21 AM   #19
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,604

Rep: Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241
Quote:
Originally Posted by procfs View Post
Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.


Thanks and Best Regards
I believe that is what it is used for. The only IP numbers not routed would be the non-routable ones.

I think this is how the Quality of Service functions are handled by iptables. By default the only thing governing the routing are the specified routes set via the "route" utility.

When I was working, this function was normally handled by the Cisco (and other vendors) routers rather than by a host. So most of my experience with it was by NAT for isolating a test machine from a network, where the test machine was being targeted for use on another network. This allowed me to test everything as if the machine was in its targeted environment, without actually being in the target environment. Installation was a "drop in" and plug-it-in - taking only seconds to accomplish. I have replaced entire Kerberos environments with such a drop in without anyone noticing I had replaced the KDC. (I found it much safer to update the OS and Kerberos that way than the usual way of updating the backup... not good to have a "test" backup server when/if the primary fails for some reason.)
 
Old 12-15-2012, 02:38 PM   #20
theNbomr
LQ 5k Club
 
Registered: Aug 2005
Distribution: OpenSuse, Fedora, Redhat, Debian
Posts: 5,396
Blog Entries: 2

Rep: Reputation: 908Reputation: 908Reputation: 908Reputation: 908Reputation: 908Reputation: 908Reputation: 908Reputation: 908
Okay, so now that we've established what problem we're chasing, I'm going to say that the solution is definitively not as simple as setting one or two kernel parameters (like net.ipv4.ip_forward = 1). A quality solution that covers all of the bases and does not leave security problems or maintenance problems involves quite a number of iptables rules, as well as sundry other settings. As someone correctly pointed out, a router and a firewall are really just two names for the same thing in this context.

procfs should use a tool made for the purpose of developing and deploying the correct collection of iptables rules. This may be in the form of GUI-based firewall creator, or a canned package of iptables rules and configurations as one or more shell scripts. These systems have been developed by people with significant expertise and experience, and have been used and refined by a cast of millions over a period of time. Having said this, I have no personal experience with the style of router that is needed here. Most or at least many packages for building firewalls/routers are geared toward the home or small business scenario, where the objective is to attach a local LAN to a single internet connection.

I'm not sure of the implications of routing between two local private networks, but I'm sure that there is a package that provides for configuration of LAN-LAN routing. I will leave it to others to suggest something. Meanwhile, it would be very very helpful if the OP could describe fully and unambiguously, the organization of the networks involved, the network interfaces of the router host, and what connectivity is desired, as well as what connectivity is to be prohibited.

--- rod.
 
Old 12-15-2012, 11:41 PM   #21
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,604

Rep: Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241
It would actually be easier to make the Linux system a bridge between two segments of the same private network... I'm not sure, but it may be possible to define the bridge to use the network 192.168.0.0 network - and thus pass both subnets to the other side. It isn't a good solution as you may as well just use one private network instead.

Private networks were set aside specifically for use in test/development environments, to ensure that that network traffic NOT get broadcast. I have seen the 10.x.x.x private network used for large clusters... Routing between two such clusters is done using public IP numbers assigned to the public interfacing nodes. And you don't get arbitrary node from cluster a to node on cluster b connections.
 
Old 12-19-2012, 11:27 AM   #22
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 595

Original Poster
Rep: Reputation: 34
Hi Guys, I was able to fix the problem "the system was not routing across networks" it was my fault not checking routing in our main Internet router "Simply there was no return path" when I add the route to the gateway router, pointing how to reach our privet 11 range things stared working . Such a trivia thing, yet I failed to see . Now I need to setup the Iptabes and get the firewall going

Thank you all for helping me.

Thank you and Best Regards
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
redhat network working but no internet thru router pengy666 Linux - Networking 6 05-10-2005 09:16 AM
redhat 7.1 as a router aristeidis Linux - Networking 0 03-22-2004 08:16 AM
can't see outside behind Redhat router KitM Linux - Networking 7 01-20-2004 07:46 PM
redhat 9 causing linksys router to stop working martygehrke Linux - Networking 1 11-13-2003 07:51 PM
RedHat 7.3 Router komakala Linux - Networking 2 10-24-2003 05:09 PM


All times are GMT -5. The time now is 09:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration