LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-10-2005, 03:54 PM   #1
ah_man04
LQ Newbie
 
Registered: Apr 2005
Distribution: Fedora Core 2
Posts: 11

Rep: Reputation: 0
build linux firewall for home ADSL


Hi all,

I am working on firewall for my home ADSL. Basically, there are two interface on my Linux (FC2) ,

eth 1 - 10.0.0.3 / 24 (Interface connect to the ADSL modem)
eth 0 - 192.168.18.3 / 24 (Home Lan)

Now my problem is when i try to surf net using my laptop (with ip 192.168.18.4) , the DNS lookup seems to be not working. When i try to ping 66.94.230.33 by using the laptop (which is ip address of www.yahoo.com), then i am able to get echo reply from the server. This mean, my address translation part should be working fine.

For the iptables,

" iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE " i have include this to enable NAT from eth 0 to eth 1.

IPV4_foward has been enabled.


Now i am wondering what caused the problem. Sorry, if i am not providing enough information. Please let me know if you need more information. Thanks a lot.

Regards,
Ahman
 
Old 04-10-2005, 04:04 PM   #2
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
you need to make sure your laptop has the proper DNS servers in it's configuration...
 
Old 04-10-2005, 04:16 PM   #3
ah_man04
LQ Newbie
 
Registered: Apr 2005
Distribution: Fedora Core 2
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by win32sux
you need to make sure your laptop has the proper DNS servers in it's configuration...
i have configured my laptop DNS server to my ISP DNS server's ip address, but it doesn't work.

Or should i configure it to my router ip address instead ? Thanks a lot
 
Old 04-10-2005, 04:21 PM   #4
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
you only need to configure it to your router's ip if you have a dns daemon running there...

if your iptables rules are forwarding all traffic from the laptop to the internet, using your ISP's dns servers on the laptop's configuration should work...

what do your other iptables rules look like??

 
Old 04-10-2005, 04:39 PM   #5
ah_man04
LQ Newbie
 
Registered: Apr 2005
Distribution: Fedora Core 2
Posts: 11

Original Poster
Rep: Reputation: 0
Hi,

I am not sure whether there is any DNS daemon running on my adsl modem/router. How can i check it ? Before i change to this configuration, i always set my laptop's DNS server and gateway to the router IP. For the previous configuration, my laptop is connected directly to the ADSL modem/router.

For the iptables rule, i will post it here as soon as possible due to i am not at home now. THanks !

Regards,
Ahman
 
Old 04-10-2005, 04:47 PM   #6
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Quote:
Originally posted by ah_man04
Hi,

I am not sure whether there is any DNS daemon running on my adsl modem/router.
what i meant when i said "router" was the linux box your are running iptables on, as it's technically considered a router if it's doing forwarding (NAT) for your laptop... i'll use the term "linux router" form now on as to not cause confusion... sorry about that...

if you can ping www.google.com from the linux router but not from the laptop, but you CAN ping internet IPs from the laptop there's one of two things that are very likely to be causing the problem:

- the dns configuration on the laptop is wrong...

- or the iptables rules on the linux router aren't forwarding the laptop's dns queries...
 
Old 04-13-2005, 11:15 AM   #7
ah_man04
LQ Newbie
 
Registered: Apr 2005
Distribution: Fedora Core 2
Posts: 11

Original Poster
Rep: Reputation: 0
Hi,

Sorry for late reply. Yup, the laptop is able top ping 66.102.7.99 (which is www.google.com), seems lke the dns is not working.

I have enable IpV4_forward

For the laptop DNS<, i have been tried configured it to my ISP's dns server, then modem/router IP , my gateway ip .. buyt
it doesn' t help.

-Attached is iptales rule

note* eth 0 means internal network with ip 192.168.18.0 / 25 , eth 1 is for connection between modem/router + my firewal.

Attached is iptales rule
--------------------------------
:PREROUTING ACCEPT [285:22267]
:POSTROUTING ACCEPT [6:384]
:OUTPUT ACCEPT [244:18203]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Thu Apr 14 00:06:59 2005
# Generated by iptables-save v1.2.9 on Thu Apr 14 00:06:59 2005
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5877:1931855]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reect-with icmp-host-prohibited
COMMIT\



Kindly plese help to check. Thank you very much. Let me know, if you need more infoormation. Thanks
 
Old 05-06-2005, 04:30 AM   #8
soitrang
LQ Newbie
 
Registered: May 2005
Posts: 1

Rep: Reputation: 0
sure ok

hi,

Only remove there line "-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited" in iptables file

Good luck !
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Home Network Setup Help Linux Server running Windoze XP clients + ADSL router BeaverusIV Linux - Networking 10 04-22-2005 04:07 PM
Build Firewall Boby Linux - Security 11 03-13-2005 12:42 AM
Linux Home Firewall stevkov Linux - Newbie 10 10-29-2003 06:27 PM
Linux as firewall / gateway + using ADSL Gianni Linux - Security 3 07-22-2003 11:05 AM
Linux firewall that supports USB ADSL & multiple public IPs? Smoothieu Linux - Security 1 08-21-2002 06:23 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:53 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration