networking with multiple IP and client

Mycado · 06-08-2006, 05:19 AM

Hello,

I have:

- One server on Debian sarge:

eth0 (inet adr:193.xx.yy.160 Bcast:193.xx.yy.255 Masque:255.255.255.0) link to internet.
eth1 (inet adr:193.xx.yy.161 Bcast:193.xx.yy.255 Masque:255.255.255.0) link to local

- Client #1 (Debian sarge):

eth0 (inet adr:193.xx.yy.10 Bcast:193.xx.yy.255 Masque:255.255.255.0) link to local with gateway: 193.xx.yy.161

- Client #2 (Debian sarge):

eth0 (inet adr:193.xx.yy.11 Bcast:193.xx.yy.255 Masque:255.255.255.0) link to local with gateway: 193.xx.yy.161

I want to internet ping be possible on 193.xx.yy.10 or 193.xx.yy.11.
packet way:
Internet > server(eth0) > server(eth1) > client#1(eth0)
client#1(eth0) > server(eth1) > server(eth0) > Internet
and
Internet > server(eth0) > server(eth1) > client#1(eth0)
client#1(eth0) > server(eth1) > server(eth0) > Internet

I test to put an IP aliasing on the server (ifconfig eth0:0 193.xx.yy.10 and ifconfig eth0:1 193.xx.yy.11)
After I launch iptable with:

Code:

iptables -t nat -A POSTROUTING -o eth0 -j ACCEPT
iptables -A FORWARD -s 193.xx.yy.11 -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -d 193.xx.yy.11 -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -s 193.xx.yy.10 -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -d 193.xx.yy.10 -i eth0 -o eth1 -j ACCEPT

But, nothing work. Someone have an idea ?

Notwerk · 06-08-2006, 07:04 AM

Hello

First, I'd like to mention the fact that all your machines are one the same network. Maybe it would be better if you changed your setup to something like this:

Server:
eth0 193.xx.yy.160
eth1 192.168.0.10

Client #1:
eth0 192.168.0.101

Client #2:
eth0 192.168.0.102

This setup would better seperate the LAN (192.168.0.xxx) from the external network (193.xx.yy.zzz).

After that (or if you decide to keep the current setup) you'll need to modify the server's routing table so it knows where to forward requests that are going to the internet:

Code:

#route add default gw [IP-of-ISP-gateway] dev eth0

And finally make sure IP Forwarding is enabled to allow the server to pass packets between the two different networks:

Code:

#echo 1 > /proc/sys/net/ipv4/ip_forward

This should get things going

I would STRONGLY recommend reading some HOW-TO on setting up a router/firewall machine.
Check here: http://www.linuxquestions.org/linux/...g/Linux_Router
and google around... happy hunting

Mycado · 06-08-2006, 07:09 AM

I don't want to have private adress like 192.168.*
Because its work perfectly with private adress, but I want to use public adress.
And its here the problem

penguintutor · 06-08-2006, 08:19 AM

To route between these then you need to put them onto two networks. This can be achieved using private addressing as Notwerk suggested, or by subnetting the network range.

Do you really have an entire class C (/24) network allocated to you, as you subnet mask suggests? All 254 host addresses available? It sounds a bit wasteful, it would be hard to get a full class C if you are only using a handful of machines, unless there is a good justification of future growth.

If you do have the full class C network then you could split this into 2 subnets using /25 addresssing (or smaller if you want to add additional networks in future).

You would change the subnet masks to 255.255.255.128, and then the eth1 address of the server would need to be changed to be lower than 127, to be in the same subnet as the two clients.

EvilC0P · 06-08-2006, 08:23 AM

and if you want to keep these public adress in your lan, you need to configure a dns as well in your lan. cuz otherwise, you wont ever find your machine's IP.
most likely you are using ur ISP's DNS servers and he points to ppl who registered those IPs.
newayz, makes no sense to use public IPs in a private LAN...

and by configuring internally a dns server to point to your own 193.x.y.z whatever machines, you wont ever be able to go to those sites on the internet. simple logic

Mycado · 06-08-2006, 09:57 AM

Quote:

Originally Posted by penguintutor

To route between these then you need to put them onto two networks. This can be achieved using private addressing as Notwerk suggested, or by subnetting the network range.

Do you really have an entire class C (/24) network allocated to you, as you subnet mask suggests? All 254 host addresses available? It sounds a bit wasteful, it would be hard to get a full class C if you are only using a handful of machines, unless there is a good justification of future growth.

If you do have the full class C network then you could split this into 2 subnets using /25 addresssing (or smaller if you want to add additional networks in future).

You would change the subnet masks to 255.255.255.128, and then the eth1 address of the server would need to be changed to be lower than 127, to be in the same subnet as the two clients.

I have the entire class (254 hosts adresse), and I don't have only 2 clients, but a lot (~180).
The problem is the routing trough the server.

r0b0 · 06-08-2006, 11:44 AM

Could you bridge the two networks?

Mycado · 06-08-2006, 05:15 PM

Quote:

Originally Posted by r0b0

Could you bridge the two networks?

Thanks, I will test tomorow

Mycado · 06-09-2006, 05:59 AM

I have test a bridge:

On the server (bridge):

Code:

brctl addbr br0

Code:

ifconfig eth0 0.0.0.0 promisc
ifconfig eth1 0.0.0.0 promisc

Code:

ifconfig br0 193.xx.yy.163

On a client:
inet adr:193.xx.yy.107 Bcast:193.xx.yy.255 Masque:255.255.255.0

193.xx.yy.161 reply on internet
But when I'm on internet, I can't ping 193.xx.yy.107 I will make a route table ? or other idea ?

Mycado · 06-09-2006, 08:21 AM

Work well now !

Thanks for your help all

Mycado · 06-09-2006, 09:50 AM

Hello,

Bridge is up, and work well !
you can see the infos here:

br0 Lien encap:Ethernet HWaddr 00:01:03:12: D1:EA
inet adr:193.xx.yy.161 Bcast:193.xx.yy.255 Masque:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth0 Lien encap:Ethernet HWaddr 00:E0:29:37:25:46
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

eth1 Lien encap:Ethernet HWaddr 00:01:03:12: D1:EA
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

Now I want to block internet ping on a local computer.
I have test with:
iptables -A FORWARD -p icmp -d 193.xx.yy.107 -j DROP

But ping are always possible on 193.xx.yy.107

Idea ?

r0b0 · 06-11-2006, 07:45 AM

Quote:

Originally Posted by Mycado

Now I want to block internet ping on a local computer.
I have test with:
iptables -A FORWARD -p icmp -d 193.xx.yy.107 -j DROP

But ping are always possible on 193.xx.yy.107

The "bridged" packets don't pass through the FORWARD chain.

They are forwarded on the "ethernet" layer, not on the IP layer, so you cannot control them by iptables. You need one more "bridge tool" - ebtables

R.