IP Forwarding won´t work

tiuz · 04-27-2006, 06:26 AM

Hello,

I want to use my box with Slackware 10.2 as a gateway for my localnet (192.168.0.0), so far everything looks fine, iptables -L nat shows this:

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
eth1_masq all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain eth1_masq (1 references)
target prot opt source destination
MASQUERADE all -- borsti.ISS/24 anywhere

borsti.ISS is the local domain.

However when i try to connect to the internet on a client (for example using ping) i can see the correct IP-Address of the "host" i ping but i just get "Host is down"
When i ping from the gateway everything works fine.

Any ideas,
Thanks,
tiuz

Centinul · 04-27-2006, 09:37 AM

Have you made sure that you turned IP Forwarding on in your gateway? I think that would be the first issue. Also I would look at the policies and output of the FORWARD chain. Hope this helps!

drkstr · 04-27-2006, 11:46 AM

Code:

#chmod +x /etc/rc.d/rc.ip_forward
#sh /etc/rc.d/rc.ip_forward start

regards,
...drkstr

drkstr · 04-27-2006, 11:50 AM

sorry to repost, but I wanted to give you an example of a basic IPtable set up that works as a gateway:

Code:

#Flush Current Ruleset
 iptables -F
 iptables -t nat -F

#Setup Default Polocies
 iptables -P INPUT ACCEPT
 iptables -P OUTPUT ACCEPT
 iptables -P FORWARD DROP

#Create Device Variables
 export LAN=eth1
 export WAN=eth0

#Lock Services to Only Work From Lan
 iptables -I INPUT 1 -i ${LAN} -j ACCEPT
 iptables -I INPUT 1 -i lo -j ACCEPT
 iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
 iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT

#Open Needed Ports
 iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT

#Drop TCP / UDP Packets to Privileged Ports
 iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
 iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP

#NAT Rules
 iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
 iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
 iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
 iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

hope this helps.
...drkstr

tiuz · 04-27-2006, 04:00 PM

IP Forwarding is on, i have made sure that /etc/rc.d/ip_forward is set to 755 and "restarted" it by hand, so this is up.
I rechecked the NAT table again but can´t find anything that would go wrong with it.

drkstr · 04-27-2006, 08:20 PM

Quote:

I rechecked the NAT table again but can´t find anything that would go wrong with it.

I am by no means an expert in networking, but shouldn't you have a FORWARD policy set up?

for instance 'iptables -L':

...
Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere 192.168.0.0/16
ACCEPT all -- 192.168.0.0/16 anywhere
ACCEPT all -- anywhere 192.168.0.0/16
...
I didn't see anything set up for this chain on your first post.

regards,
...drkstr