Hi all,

I've been looking through threads and reading trying to solve this problem to no avail, so I come to you for advice.

I have a dual boot W98/Mandrake 10 box acting as a host to a Win98 box. When the W98 (host) is running it performs ICS fine with the client. However when I am running MDK on the host it is unable to ping the client, not is the client unable to ping the host. My aim is to have MDK 10 eventually acting as the host for ICS to the W98 box

When I try to ping the W98 box (IP address 192.168.0.2 subnet 255.255.255.0) I get destination host unreachable. The host (IP address 192.168.0.1 subnet 255.255.255.0) pings itself fine.


My iptables -L shows:

-----------------------------------------------------------------------------------------------------------
[root@localhost geoff]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP !icmp -- anywhere anywhere state INVALID
ppp_in all -- anywhere anywhere
eth0_in all -- anywhere anywhere
common all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:INPUT:REJECT:'
reject all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
DROP !icmp -- anywhere anywhere state INVALID
ppp_fwd all -- anywhere anywhere
eth0_fwd all -- anywhere anywhere
common all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:FORWARD:REJECT:'
reject all -- anywhere anywhere

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP !icmp -- anywhere anywhere state INVALID
fw2net all -- anywhere anywhere
all2all all -- anywhere anywhere
common all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:OUTPUT:REJECT:'
reject all -- anywhere anywhere

Chain all2all (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB
LISHED
newnotsyn tcp -- anywhere anywhere state NEW tcp flags
:!SYN,RST,ACK/SYN
common all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:all2all:REJECT:'
reject all -- anywhere anywhere

Chain common (5 references)
target prot opt source destination
icmpdef icmp -- anywhere anywhere
reject udp -- anywhere anywhere udp dpt:135
reject udp -- anywhere anywhere udp dpts:netbios-ns
:netbios-ssn
reject udp -- anywhere anywhere udp dpt:microsoft-d
s
reject tcp -- anywhere anywhere tcp dpt:netbios-ssn

reject tcp -- anywhere anywhere tcp dpt:microsoft-d
s
reject tcp -- anywhere anywhere tcp dpt:135
DROP udp -- anywhere anywhere udp dpt:1900
DROP all -- anywhere 255.255.255.255
DROP all -- anywhere BASE-ADDRESS.MCAST.NET/4
reject tcp -- anywhere anywhere tcp dpt:auth
DROP udp -- anywhere anywhere udp spt:domain stat
e NEW
DROP all -- anywhere 192.168.0.255

Chain dynamic (4 references)
target prot opt source destination

Chain eth0_fwd (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state NEW
loc2net all -- anywhere anywhere

Chain eth0_in (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state NEW
loc2fw all -- anywhere anywhere

Chain fw2net (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB
LISHED
newnotsyn tcp -- anywhere anywhere state NEW tcp flags
:!SYN,RST,ACK/SYN
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:h
ttp
ACCEPT all -- anywhere anywhere

Chain icmpdef (1 references)
target prot opt source destination

Chain loc2fw (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB
LISHED
newnotsyn tcp -- anywhere anywhere state NEW tcp flags
:!SYN,RST,ACK/SYN
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:s
quid
all2all all -- anywhere anywhere

Chain loc2net (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB
LISHED
newnotsyn tcp -- anywhere anywhere state NEW tcp flags
:!SYN,RST,ACK/SYN
ACCEPT all -- anywhere anywhere

Chain net2all (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB
LISHED
newnotsyn tcp -- anywhere anywhere state NEW tcp flags
:!SYN,RST,ACK/SYN
common all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:net2allROP:'
DROP all -- anywhere anywhere

Chain newnotsyn (5 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level info pref
ix `Shorewall:newnotsynROP:'
DROP all -- anywhere anywhere

Chain ppp_fwd (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state NEW
net2all all -- anywhere anywhere

Chain ppp_in (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state NEW
net2all all -- anywhere anywhere

Chain reject (11 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-res et
REJECT udp -- anywhere anywhere reject-with icmp-po rt-unreachable
REJECT icmp -- anywhere anywhere reject-with icmp-ho st-unreachable
REJECT all -- anywhere anywhere reject-with icmp-ho st-prohibited

Chain shorewall (0 references)
target prot opt source destination

----------------------------------------------------------------------------------------------

I've modified the /etc/stsctrl.conf as follows to allow IP packets:

From net.ipv4.ip_forward = 0 to net.ipv4.ip_forward = 1 (to forward Ip packets)

I must admit, I'm out of ideas, can nayone help with this?

Many thanks in advance

Welcome to LQ.

It looks like your firewall is dropping ICMP packets - hence you can't ping. Perhaps if you were to simplify your firewall rules a little bit they would be easier to understand.

I just dropped all the setting for the firewall via MCC, ie selected no firewall and everything works. Such a straight forward solution for something I've been banging my head about for days.

All I have to do now is to secure the host machine...Many thanks