PDA ip forwarding or routing problem

Mechanic · 11-26-2006, 11:32 PM

My setup: PC running FC5 connected to LAN via router. PDA running Linux connected to this PC through usb network connection. IP addresses are as follows:

PC:
eth0: 192.168.2.1
usb0: 192.168.129.1

PDA:
usbd0: 192.168.129.201

I want to be able to have PC forward packets from usb0 (from PDA) to LAN (to default gateway). I have ip_forwarding enabled on PC and firewall is disabled. From PC I can ping PDA and router; from PDA I can ping PC. But I can't ping router from PDA. Seems packets are not being forwarded. PC routing table:

Code:

> /sbin/route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.129.0   *               255.255.255.0   U     0      0        0 usb0
default         router          0.0.0.0         UG    0      0        0 eth0

PDA routing table:

Code:

> /sbin/route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.129.0   *               255.255.255.0   U     0      0        0 usbd0
default         192.168.129.1   0.0.0.0         UG    0      0        0 usbd0

I thought packets coming to the PC from the PDA would be forwarded to the default gateway (router) and packets going to the PDA from the PC should use the route listed first.

Any thoughts?

Tim

jschiwal · 11-27-2006, 12:33 AM

Check if you have the ip_conntrack module loaded on your desktop. At one time I used my laptop to route the traffic from my desktop to my wireless router. I needed to modprobe ip_conntrack before ip forwarding would work.

amitsharma_26 · 11-27-2006, 06:02 AM

Quote:

Originally Posted by Mechanic

I thought packets coming to the PC from the PDA would be forwarded to the default gateway (router) and packets going to the PDA from the PC should use the route listed first.

Tim,

Your adsl router would'nt be returning back packets with source of 192.168.129.* becuase of unavailability of route at its own end. Definately your linux box is forwarding them to your adsl router but router is not returning them back.

All you need in this scenario is to enable firewall & do SNATing all the packets recieved from PDA to router with Source ip of 192.168.2.1

Code:

iptables -t nat -A POSTROUTING -s 192.168.129.1 -j SNAT --to 192.168.2.1

Thats it !

Mechanic · 11-29-2006, 08:37 PM

amitsharma_26, why wouldn't the router return the packets from 192.168.129.*? Don't routers use ARP to build internal routing tables?

In any case, I tried changing the subnet of the PDA to that of the rest of the network to circumvent the router problem.

Configuration is now like this:

PC:
eth0: 192.168.2.1
usb0: 192.168.2.2

PDA:
usbd0: 192.168.2.3

And the routing tables of each:

PC:

Code:

>/sbin/route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.3     *               255.255.255.255 UH    0      0        0 usb0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

PDA:

Code:

>/sbin/route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     0      0        0 usbd0
default         192.168.2.2     0.0.0.0         UG    0      0        0 usbd0

I used tcpdump to monitor the traffic on eth0 while pinging router (192.168.2.1) from PDA, but there was nothing. Seems like packets are not being forwarded. I am able to ping the PC from the PDA.

I'm confused

Tim

Mechanic · 11-29-2006, 09:30 PM

Also, if I monitor the PC's network adapter usb0 while pinging router from PDA, I see an arp request from the PDA for the router's hardware address (but still nothing on eth0).

Tim

amitsharma_26 · 11-30-2006, 07:52 AM

Quote:

Originally Posted by Mechanic

amitsharma_26, why wouldn't the router return the packets from 192.168.129.*? Don't routers use ARP to build internal routing tables?

Which router are we talking in here ? ADSL modem or a Linux router or any other specific make ROUTER ??

Quote:

Originally Posted by Mechanic

Configuration is now like this:

PC:
eth0: 192.168.2.1
usb0: 192.168.2.2

PDA:
usbd0: 192.168.2.3

I used tcpdump to monitor the traffic on eth0 while pinging router (192.168.2.1) from PDA, but there was nothing. Seems like packets are not being forwarded. I am able to ping the PC from the PDA.

This above quote is a bit ambiguous, You said you are able to ping PC but not ROUTER though router as you specified is eth0 at your PC.

Now I stand confused as well. Can you kindly correct the statement or justify it a bit more in detail ?

Mechanic · 11-30-2006, 11:39 AM

The router I have is a 4 port Belkin router.

Sorry, there was a mistake in my second to last post. The IP of the router was correct: 192.168.2.1. The ip of eth0 on the PC is 192.168.2.95. The rest should be correct.

Thanks for your patience and help so far.
Tim

Mechanic · 12-08-2006, 11:45 PM

I still have not solved this one. Can anyone help me with this?

I've used tcpdump to verify that I'm getting packets to the PC from the PDA to usb0, but if I monitor eth0, I do not see the packets that I expect to be forwarded.

I'm running FC5, kernel 2.6.18-1.2239.fc5. Is it possible that the Fedora kernels do not have forwarding capability by default? I'm getting to my wits end with this one.

Any help would be greatly appreciated.

Tim

amitsharma_26 · 12-09-2006, 03:48 PM

At you PDA,
you got to specify static route to your ADSL router
e.g. ip rou to adsl-router-ip via pc1-ip

On PC,
You got to specify static routes to & from your PDA.
e.g. ip rou to pda-ip via usb0-ip

& With this your packets(generated by pda) will reach your adsl router(half work done), but the problem comes for these packets to return & i am not sure but i heard that if you can manage your arp requests with ebtables(or any other method) to redirect these arp queries to your USB box, this scenario can work.

Now you go & surf google on these inputs & give it a try. Repost.. i'll try to look into the same tommorow.

amitsharma_26 · 12-09-2006, 03:52 PM

For the same, you can go through this link & see if you find something suitable for your needs.. http://ebtables.sourceforge.net/examples.html

Mechanic · 12-11-2006, 11:22 PM

It's fixed! amitsharma_26, your first comment to me was correct. The router was making arp requests to find out the ethernet address of the PDA, but, as it turns out, arp requests are broadcast and the PC does not forward broadcasts - the PDA never got the arp request. Once I got the routes set up properly and entered the proper NAT line, it worked.

amitsharma_26, thank you very much for your help and patience. I learned a great deal in fixing this problem.

There is one last problem though. I can ping the router from the PDA, but if I try to ping www.google.com, I get the following error: 'Host name lookup failure'. Running tcpdump on eth0 of PC I get the following (paraphrased) error:

Code:

00:08:31.434795 IP 192.168.129.3.1024 > 192.168.2.1.domain:  49279+ A? www.google.com. (32)
00:08:31.434867 IP 192.168.129.1 > 192.168.129.3: ICMP host 192.168.2.1 unreachable - admin prohibited, length 68

I have the router (IP 192.168.2.1) set as the DNS on the PDA. Although I can ping the router from the PDA, it appears that it's not working properly as the DNS. Any thoughts on this one?

Tim

amitsharma_26 · 12-12-2006, 07:12 AM

Quote:

Originally Posted by Mechanic

There is one last problem though. I can ping the router from the PDA, but if I try to ping www.google.com, I get the following error: 'Host name lookup failure'. Running tcpdump on eth0 of PC I get the following (paraphrased) error:

Code:

00:08:31.434795 IP 192.168.129.3.1024 > 192.168.2.1.domain:  49279+ A? www.google.com. (32)
00:08:31.434867 IP 192.168.129.1 > 192.168.129.3: ICMP host 192.168.2.1 unreachable - admin prohibited, length 68

I have the router (IP 192.168.2.1) set as the DNS on the PDA. Although I can ping the router from the PDA, it appears that it's not working properly as the DNS. Any thoughts on this one?

As you can see the message of "Communication with Destination Host is Administratively Prohibited" in your logs, it really meant what it has written. You are blocking these packets on the way back to PDA; you got to allow these packets at your PC1. Checkout all your iptables rules or post them here.

Mechanic · 12-12-2006, 07:11 PM

Why am I able to ping the router but I cannot contact it when using it as a nameserver? The PC is not even forwarding these packets. Anyway, here is my setup as it is now:

PC:
eth0 IP: 192.168.2.95
usb0 IP: 192.168.129.1

routing table:

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.129.0   0.0.0.0         255.255.255.0   U     0      0        0 usb0
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

PDA:
usbd0 IP: 192.168.129.3

routing table:

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.129.0   0.0.0.0         255.255.255.0   U     0      0        0 usbd0
0.0.0.0         192.168.129.1   0.0.0.0         UG    0      0        0 usbd0

Here are the iptables rules (I have not changed these; they are Fedora Core 5 default):

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     ipv6-crypt--  anywhere             anywhere
ACCEPT     ipv6-auth--  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

and the NAT table:

Code:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  192.168.129.3        0.0.0.0/0           to:192.168.2.95

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I'll do some more research on iptables rules and see if I can figure this out.

Thanks again.
Tim

amitsharma_26 · 12-13-2006, 10:50 AM

Quote:

Originally Posted by Mechanic

Why am I able to ping the router but I cannot contact it when using it as a nameserver? The PC is not even forwarding these packets.

You got to allow your DNS packets & then the NATed packets to pass from the default firewall you have. At present you can see that under Chain RH-Firewall-1-INPUT at second nos; you have icmp packets allow from anywhere to anywhere & thats why you can ping the router.

For Nated packets & name resolutions to work;
open /etc/sysconfig/iptables
& copy paste

Code:

-A RH-Firewall-1-INPUT -s 192.168.129.3 -p tcp -m multiport --dports 53,443,80 -j ACCEPT 
-A RH-Firewall-1-INPUT -s 192.168.129.3 -p udp --dport 53 -j ACCEPT

Just above the
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

& do a service iptables restart.

After your iptables restart; you got to run that SNATing rule again to bring NATing in effect.
EDIT : IP Correction.

Mechanic · 12-13-2006, 11:15 AM

It's fixed! I had to make a slight change to the lines you gave me to enter into /etc/sysconfig/iptables: I had to use the IP of the PDA: 192.168.129.3 instead of 192.168.129.1. But it works. Thanks again for all of your help.

Tim