External nic unreachable from local network
Hi.
I've got router with: eth2 - local network (192.168.1.1), ppp0 - uplink (x.y.z.a) my firewall: Code:
# Generated by iptables-save v1.4.5 on Mon Jan 11 12:22:25 2010 external interface ip is unreachable, i.e. clients can't reach x.y.z.a. according to tcpdump packets are transmitted to router, but there's no response. somehow iptables -t nat -A PREROUTING -i eth2 -d x.y.z.a -j DNAT --to-destination 192.168.1.1 helps, but imho there should be some other solution. any ideas? kernel is 2.6.31.6, architecture is x86_64. P.S. i've also tried iptables -A POSTROUTING ! -d x.y.z.a -s 192.168.1.0/24 -j MASQUERADE that didn't help either. |
Quote:
Your route may respond nothing, and it is good. Try to ping it interface, but check if ICMP is enabled. |
I'm afraid I am beyond my understanding with this suggestion, but the example iptables scripts that I can find does not specify a source parameter in the nat POSTROUTING line, so try instead of (in the *nat section):
-A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE just: -A POSTROUTING -o ppp0 -j MASQUERADE and see if that helped. Perhaps the address gets translated before the postrouting occurs? If this is correct I am sure there is someone here that can provide insight. Regards |
Quote:
i'm doing ping, pings are enabled, but it doesn't work. Quote:
|
Are you trying to ping it from outside or from LAN?
If from LAN pings really may not return, and from LAN you should ping LAN interface of you router. I also suggest to turn firewall OFF for test period. |
Quote:
Code:
iptables -t nat -A PREROUTING -i eth2 -d x.y.z.a -j DNAT --to-destination 192.168.1.1 |
What do you want exactly to achieve?
Do you want someone from outside be able to connect to your LAN? |
no, i want someone from inside (lan) to be able to connect to routers external interface
|
Have you got ip forwarding enabled on the server?
Code:
sudo echo 1 > /proc/sys/net/ipv4/ip_forward |
Quote:
If you want to manage your router you have to connect to it LAN interface, which is GW for your network. |
iptables -t nat -A PREROUTING -i eth2 -d x.y.z.a -j DNAT --to-destination 192.168.1.1
|
All times are GMT -5. The time now is 09:44 AM. |