iptables. Can ping through to internet side nic but can't get to internet

gonus · 07-12-2004, 09:41 PM

hello all. here is the iptable.comf

#!/bin/sh

# iptables script generator: V0.1-2002
# Comes with no warranty!
# e-mail: michael@1go.dk

# Diable forwarding
echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_IP_NET='20.20.20.28/40
LAN_NIC='eth1'
WAN_IP='65.xx.xx.233'
WAN_NIC='eth0'

# load some modules (if needed)
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

# Flush
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# enable Masquerade and forwarding
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Open ports on router for server/services
iptables -A INPUT -j ACCEPT -p tcp --dport 80
iptables -A INPUT -j ACCEPT -p tcp --dport 21

# STATE RELATED for router
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

as stated in title. I can't get to the internet. I have my linux box with eth0 connecting to the internet. eth1 is connected to my lan (through a hub). Well I can ping my ip on eth0 from any machine on my lan. I can't get to the internet though. My linux box is also my dhcp server. Any help is appreciated.

Capt_Caveman · 07-12-2004, 09:45 PM

echo 0 > /proc/sys/net/ipv4/ip_forward
you want forwarding turned *ON*. Change that to:
echo 1 > /proc/sys/net/ipv4/ip_forward

ppuru · 07-12-2004, 10:03 PM

Can you browse the net from your linux box?
are your DNS resolutions on the clients good?

gonus · 07-12-2004, 10:03 PM

I changed that. Still not working. Did a reboot on both machines to make sure.

gonus · 07-12-2004, 10:07 PM

I can browse the net on my linux box. I try a dns lookup and I get nothing. But my dhcpd.conf does not include a dns server because my lan currently does not ahve a dns server. I pinged google from linux. I get ip. (only way i know to get an ip with linux other than my own) I ping ip from window box and fail. request times out.

Capt_Caveman · 07-12-2004, 10:32 PM

LAN_IP_NET='20.20.20.28/40

That CIDR notation throws an error for me. Should it be 32 or 24? Check the output of iptables -n -L -v (as well as the nat table) to be sure it's loading.

ppuru · 07-12-2004, 10:34 PM

Does your ISP provide you your IP via DHCP or is it a static address. You may simply include the dns servers of your ISP in dhcpd.conf.

Alternatively, you can start DNS service on your system, and put in the IP of your LAN interface as the dns server address in your dhcpd.conf

ppuru · 07-12-2004, 10:39 PM

Quote:

That CIDR notation throws an error for me. Should it be 32 or 24? Check the output of iptables -n -L -v (as well as the nat table) to be sure it's loading.

Adding to Capt_caveman's post ... you can a subnet from the Private (unregistered) addresses

10.0.0.0 -10.255.255.255
172.16.0.0-172.31.255.255
192.168.0.0- 192.168.255.255

gonus · 07-13-2004, 08:06 AM

I used 20.20.20.x because thats what the howto I was readign was using. Umm heres a ? 20.20.20.28/40 (this is what I thought) is the range of ip's that will be accepted from the lan. Is that correct or is it supposed to be the network and subnet? I am currently unabel to work on this (at work) but I would think its loading because I was unable to ping through to the internet nic eth0 until I fixed the iptable. (somewhat fixed I can ping through to eth0 but still unable to get internet.)

Capt_Caveman · 07-13-2004, 08:35 AM

/32 would specify only the 20.20.20.28 host.
/24 would specify the 20.20.20.0-255 subnet

To my knowledge there is no /40 in CIDR notation (IP addresses only have 32 bits). If you enter that command using the command line :

Code:

[root@Helios root]# iptables -A FORWARD -i eth0 -s 20.20.20.20/40 -j ACCEPT
iptables v1.2.9: invalid mask `40' specified
Try `iptables -h' or 'iptables --help' for more information.

Btw, 20.20.20.28 is a valid public IP address that's owned by someone and isn't a private IP block like 10.10 or 192.168 (I believe that's what ppuru was telling you). If you have your routing table setup properly it should work, but you may get weird results.

gonus · 07-13-2004, 01:26 PM

Ahhhhh. I see said the blind man. Thats were I thought this was going. So tonight I will change by dhcp scope to the 192.168.x.x range. Then I will use the script posted on my dns post and hopefully I will have better luck. I appreciate the explanation.

gonus · 07-13-2004, 07:37 PM

Guys I am like back to square one. I have reset the dhcp scope to 192.168.0.2-6. I set the eth1 to 192.168.0.6. I used the www.iptables-script.dk iptable script. Now I am back to unable to ping outside. Here ismy new conf I am overlooking again but I ned help as I am still a newb

#!/bin/sh

# iptables script generator: V0.1-2002
# Comes with no warranty!
# e-mail: michael@1go.dk

# Diable forwarding
echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_IP_NET='192.168.0.1/24'
LAN_NIC='eth1'
WAN_IP='68.113.72.168'
WAN_NIC='eth0'

# load some modules (if needed)

# Flush
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# enable Masquerade and forwarding
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# STATE RELATED for router
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

ppuru · 07-13-2004, 09:40 PM

your lan ip net should read as

LAN_IP_NET='192.168.0.0/24'

Capt_Caveman · 07-13-2004, 10:30 PM

Your script works just fine on my test LAN. The only catch I can see is that you aren't allowing any NEW incoming traffic between the LAN machines and the firewall, so if it's also acting as as a dhcp/dns server, then it could be causing problems. So try this just in case:
iptables -A INPUT -i $LAN_NIC -s $LAN_IP_NET -j ACCEPT

You might also want to take a look at the networking setup of the client (miss-configuring things like the gateway IP, DNS, etc might be the culprit ). As well as the boot logs of the client to see if it's having any networking related errors.

ppuru · 07-13-2004, 10:50 PM

Capt_Caveman is right ... LAN traffic was blocked; missed that small thing that had a huge impact