[SOLVED] IPv4 Forwarding and ALLOW ALL

irreverentryan · 05-03-2013, 09:31 AM

I've got a linux machine that is setup to be a router in this fashion:

192.168.0.0/22
|
|
192.168.1.16 (br0)
/
192.168.10.100 (br1)
|
|
192.168.10.0/24

All the hosts on the 192.168.10.0 network can ping eachother, their gateway (192.168.10.100) and anything on the 192.168.0.0 network (including it's gateway, 192.168.1.244) When I issue the command, "ping google.com" the DNS resolves it properly, but the ping never goes through. I cannot access the internet in any way from 192.168.10.0.

I have enable IP forwarding, and I have set up some rules in IPTABLES, but they confuse me, so I'm sure I'm not doing something right. I'd prefer to have direct access to/from each side of this routing box. Straight passthrough, no filtering, no security, etc, just direct routes in and out.

irreverentryan · 05-03-2013, 10:24 AM

It seems the network works exactly the same with or without the iptables firewall running, so I've disabled it to further test. Again, this is an internal gateway/router that should simply be providing access to/from the 192.168.10.0 network.

irreverentryan · 05-03-2013, 10:38 AM

I digress, iptables did make a difference, so it's back on now.

irreverentryan · 05-03-2013, 02:03 PM

I was able to reproduce what I'm aiming for with a Cisco RVS 4000 Router. I simply setup the two conenctions, and disabled all security... BOOM got what I wanted... How do I do this simple task in iptables? Or even without iptables?

Habitual · 05-03-2013, 02:20 PM

Some of my more 'creative' iptables stuff (code) I stole from http://www.cyberciti.biz/tips/linux-...allow-ssh.html

I hope it can be of help for you also.

Edit: Specifically, near the bottom of the page it reads:

Code:

# Allow incoming ssh only from IP 202.54.1.20
iptables -A INPUT -p tcp -s 202.54.1.20 -d $SERVER_IP --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $SERVER_IP -d 202.54.1.20 --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT

irreverentryan · 05-06-2013, 03:34 PM

Alright, I'm going to try to take unneeded confusion out of the mix.
-No iptables
-No virtual networking

Now my setup is as follows:
192.168.0.0/22 <----->192.168.1.16 | 192.168.10.100<---->192.168.10.0/24

I have a computer(A) on the 192.168.10.0/24 network. Its gateway is 192.168.10.100, and its IP is 192.168.10.5. It has a static route to 192.168.0.0/22 via 192.168.10.100.
I have a computer(B) on the 192.168.0.0/22 network. Its gateway is 192.168.1.244 and its IP is 192.168.1.242. It has a static route to 192.168.10.0/24 via 192.168.1.16.

I have a routing machine in between (VMHOST). VMHOST is setup with two nics; br0, which is assigned 192.168.1.16, and br1, which is assigned 192.168.10.100.
The default gateway for this machine is 192.168.1.244, and it is directly connected to both 192.168.0.0/22 and 192.168.10.0/24. I can access and ping Google.com successfully.
I have ipv4_forwarding turned on. Firewalls turned off.

From Host A, I can ping its gateway, 192.168.10.100. I can also ping the other side of the routing machine, 192.168.1.16, as well as any other address on the network with a static route to 192.168.10.0/24, including the "true" gateway, 192.168.1.244 (which has a static route in it.) I cannot ping google.com (unknown host.) I am able to ping my DNS servers, and my gateway, but I am unable to go any further. I cannot ping 8.8.8.8 (to test if DNS is an issue, which it is obviously not)

From Host B, I can ping its gateway, 192.168.1.244, as well as anything on the 192.168.10.0 network with a static route to 192.168.0.0/22. Host B is able to access the internet.

Anyone have any idea why the hell I can ping across my whole network, including all gateways, but I can't get out to the dang internet??

irreverentryan · 05-06-2013, 04:27 PM

My firewall was blocking it because it was spoofed!! All set, thanks anyways!