Connection sharing to W2K Server

dwynter · 07-01-2002, 12:50 PM

Got rid of the superfluous repeated code listing

dwynter · 07-01-2002, 12:56 PM

Third time RTFM

Code:

Host Name . . . . . . . . . . . . : roamware-2eg62k
Primary DNS Suffix . . . . . . . : development.roamware.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : development.roamware.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : CNet PRO200 PCI Fast Ethernet Adapter #2
Physical Address. . . . . . . . . : 00-80-XX-YY-XX-YY
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.6
Subnet Mask . . . . . . . . . . . : 255.0.0.0
Default Gateway . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 213.120.62.103
213.120.62.104

Ethernet adapter Local Area Loopback:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Loopback Adapter
Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.4
Subnet Mask . . . . . . . . . . . : 255.0.0.0
Default Gateway . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 213.120.62.103
213.129.62.104

C:\>netstat -ar

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...02 00 4c 4f 4f 50 ...... MS LoopBack Driver
0x1000004 ...00 80 xx yy xx yy ...... CNet PRO200 PCI Fast Ethernet Adapter
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.0.1        10.0.0.6       1
          0.0.0.0          0.0.0.0         10.0.0.1        10.0.0.4       1
         10.0.0.0        255.0.0.0         10.0.0.4        10.0.0.4       1
         10.0.0.0        255.0.0.0         10.0.0.6        10.0.0.6       1
         10.0.0.4  255.255.255.255        127.0.0.1       127.0.0.1       1
         10.0.0.6  255.255.255.255        127.0.0.1       127.0.0.1       1
   10.255.255.255  255.255.255.255         10.0.0.4        10.0.0.4       1
   10.255.255.255  255.255.255.255         10.0.0.6        10.0.0.6       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        224.0.0.0         10.0.0.4        10.0.0.4       1
        224.0.0.0        224.0.0.0         10.0.0.6        10.0.0.6       1
  255.255.255.255  255.255.255.255         10.0.0.4        10.0.0.4       1
Default Gateway:          10.0.0.1
===========================================================================
Persistent Routes:
  None

dwynter · 07-01-2002, 01:08 PM

A quick question.

If someone knows the ethernet address of a physical NIC in one of your systems behind a firewall does this expose that system to any form of attack?

David

Griffon26 · 07-02-2002, 02:27 AM

Dwynter, what you should try is run tcpdump as root on the linux box. You should be able to see all packets going over your LAN (check that by pinging from the Win98 box to the 2K box or the other way around). Then check if there's anything being sent when you ping the gateway from your 2K box.

Btw, I looked up what the local loopback adapter was for and it seems it is only necessary if you don't have any real NICs in your computer. Some apps seem to need an adapter to function even if they only try to contact your own computer (MS SQL server for instance).

dwynter · 07-02-2002, 10:43 AM

I did tcpdump thing. I pinged from Win98 to W2K box, then I pinged from W2K to W98, which did not appear and then finally pinged from W2K to gateway on Linuxbox and that did not appear. Clearly the W2K box is not letting these icmp packets out. The W2K box did have Tiny Personal Firewall on it, but I'd stopped that running. It also had the ADSL modem icon on the taskbar as a red colour, I killed that too. I need to find out what process on the W2k box is filtering out all IP packets from going out. I have posted to a Windows newsgroup to see what they say.

David

dwynter · 07-03-2002, 05:15 AM

Some progress at last.

I disabled the Loopback Adapter on the W2K box and I can now ping th egateway and the other notebook on the network. Bu twhen i try to ping the DNS IP it fails and therefore the borwser and email cannot resolve their servers.

The output from "pathping 213.120.62.103 -n" (the DNS address on the ISP I use) is

Code:

Tracing route to 213.120.62.103 over a maximum of 30 hops

 0  10.0.0.6
 1  10.0.0.1
 2  ...
Computing  statistics for 50 seconds...
etc

The part in the etc above shows 100% packet loss between 10.0.0.1 (the gateway and 0.0.0.0. I don't know what the0.0.0.0 represents though but it is the last hop.

Any ideas what to do next?

David

dwynter · 07-03-2002, 06:21 AM

Well knock me down with a wet barramundi, I restarted the iptables script and all is well. I didn't change anything in it so I don't know what happened?

Thanks for those that helped, my knowledge of TCP/IP tools and routing in general is now much greater than the 0 it was.

David