forward don't forward

marco-slack · 04-05-2006, 04:49 PM

This is the gateway:

.............................. +----------------------------------------------+
192.168.0.0/24---------|eth0(192.168.0.254)..............................|
192.168.2.0/24---------|eth2(192.168.2.254)...eth1(192.168.1.254)|-------192.168.1.0/24
...............................+----------------------------------------------+

[bad ascii-art

]

the routing table from the gateway:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.2.0 * 255.255.255.0 U 0 0 0 eth2
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
localnet * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.1.1 0.0.0.0 UG 1 0 0 eth1

the routing table from 192.168.0.10 (on the 192.168.0.0 net):

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.0.254 0.0.0.0 UG 0 0 0 eth0

on the gateway I exec:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -i eth0 -j ACCEPT

from GW I can ping all the machines
from 192.168.0.10 I can ping 192.168.0.254(GW)
why I can't ping from 192.168.0.10 to 192.168.1.1(located on 192.168.1.0 net)

thanks

win32sux · 04-06-2006, 05:51 AM

Quote:

Originally Posted by marco-slack

This is the gateway:

.............................. +----------------------------------------------+
192.168.0.0/24---------|eth0(192.168.0.254)..............................|
192.168.2.0/24---------|eth2(192.168.2.254)...eth1(192.168.1.254)|-------192.168.1.0/24
...............................+----------------------------------------------+

[bad ascii-art

]

the routing table from the gateway:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.2.0 * 255.255.255.0 U 0 0 0 eth2
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
localnet * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.1.1 0.0.0.0 UG 1 0 0 eth1

the routing table from 192.168.0.10 (on the 192.168.0.0 net):

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.0.254 0.0.0.0 UG 0 0 0 eth0

on the gateway I exec:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -i eth0 -j ACCEPT

from GW I can ping all the machines
from 192.168.0.10 I can ping 192.168.0.254(GW)
why I can't ping from 192.168.0.10 to 192.168.1.1(located on 192.168.1.0 net)

thanks

hi there, welcome to LQ...

your problem could be caused by several things, but if your policy is set to DROP (as it should be), then the problem is likely that you aren't accepting the packets which are coming back (of a state ESTABLISHED)...

either way, this is how i would do it:

Code:

echo "0" > /proc/sys/net/ipv4/ip_forward

iptables -F FORWARD

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -s 192.168.0.0/24 \
-m state --state NEW -j ACCEPT

iptables -A FORWARD -i eth2 -o eth1 -s 192.168.2.0/24 \
-m state --state NEW -j ACCEPT

iptables -A -t nat POSTROUTING -o eth1 -j SNAT \
--to-source 192.168.1.254

echo "1" > /proc/sys/net/ipv4/ip_forward

marco-slack · 04-06-2006, 04:51 PM

Great, now it works

Thanks very much