LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-05-2004, 10:37 AM   #1
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Rep: Reputation: 0
Strange IPchains / Network Issue


Hi Guys,
Two networks - 10.0.0.0/8 & 192.168.1.0/24 connected through VPN - GRE Tunnel. Machines of one network can ping the other network. Ipchains Firewall gateway 10.0.0.5 in 10.0.0.0 network. Proxy Squid running on 3128 on 10.0.0.5.

Rule for 10.* network in ipchains to access proxy 10.0.0.5

/sbin/ipchains -A input -i eth1 -s 10.0.0.0/255.0.0.0 -d 10.0.0.5 3128 -p tcp -j ACCEPT
/sbin/ipchains -A output -i eth1 -s 10.0.0.5 3128 -d 10.0.0.0/255.0.0.0 ! -y -p tcp -j ACCEPT

Rule for 192.* network in ipchains to access proxy 3128 in 10.0.0.5

/sbin/ipchains -A input -i eth1 -s 192.168.1.0/255.255.255.0 -d 10.0.0.5 3128 -p tcp -l -j ACCEPT
/sbin/ipchains -A output -i eth1 -s 10.0.0.5 3128 -d 192.168.1.0/255.255.255.0 ! -y -p tcp -l -j ACCEPT


Problem is that only one machine (Lets says abc machine IP - 192.168.1.1) from that network is able to browse the internet. None of the other machines 192.168.1.3, 192.168.1.4 etc are not able to browse. If 192.168.1.1 IP is given for any other machine then, that machine is not able to browse. If ABC machine is given 192.168.1.34 then it is able to browse.

How do we solve the problem. Route and reverse route for both networks are working perfectly.

Thanks,
Raghavan.S
 
Old 08-05-2004, 11:05 AM   #2
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
Hope the default gateway for the machines on 192.168.1.0 are set to the gateway machine - the machine that participates in the VPN establishment.
 
Old 08-05-2004, 10:44 PM   #3
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Original Poster
Rep: Reputation: 0
VPN establishment gateway is 192.168.1.2 and all machines are set to this gateway. But the machine ABC on which 192.168.1.1 is working perfectly(Browsing). Even if we change the IP on the ABC machine it is working perfectly. But not another machine if we change the IP from 192.168.1.x to 192.168.1.1.

If you would like the TCPDUMP occuring when the ABC machine browses and other machines when it reaches the firewall, pls reply back.

Raghavan.S
 
Old 08-05-2004, 10:54 PM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
//Looking more like a networking issue rather than security. Moving thread over to the Linux - Networking for more exposure.
-CC
 
Old 08-05-2004, 11:01 PM   #5
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Original Poster
Rep: Reputation: 0
I dont know whether it is a networking or Security issue. Because if I turn off firewall all machines are able to browse with the appropriate access in Squid ACL. But the strange issue is why is it browsing in ABC machine even when we change the IP and give the IP appropriate rights in ACL squid.

This is really strange and we are breaking our heads for the past 2 weeks.

Raghavan.S
 
Old 08-05-2004, 11:03 PM   #6
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Original Poster
Rep: Reputation: 0
One more small thing is that if I give access to a webserver running in Firewall all machines are able to hit the webserver. And even more so, If I remove access for the machines in ACL Squid, I am getting the page - Squid's Access Denied in the machines.

Raghavan.S
 
Old 08-05-2004, 11:19 PM   #7
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
are these other machines - the ones other than ABC - able to ping the gateway?
 
Old 08-05-2004, 11:25 PM   #8
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Original Poster
Rep: Reputation: 0
All machines 192.168.1.x are able to ping machines in 10.x subnet.

Raghavan.S
 
Old 08-06-2004, 12:40 AM   #9
rags
LQ Newbie
 
Registered: Aug 2004
Posts: 6

Original Poster
Rep: Reputation: 0
I am running a Redhat 6.2. Kernel Version 2.2.14-5.0. Is there any bug with this version of Redhat Linux??

Raghavan.S
 
Old 08-06-2004, 08:30 AM   #10
jdelaros1
LQ Newbie
 
Registered: Sep 2003
Location: Austin, TX USA
Distribution: Fedora 1.0, 2.0 & SuSE 9.2
Posts: 20

Rep: Reputation: 0
If only one machine works (ABC, regadless of its IP address) and all others don't, then obvioulsy you need to see what is different about ABC: Could be a physical issue? Something particular about the port (router, switch...)ABC is connected to?

Have you considered plugging ABC to a different port? Using a different network cable? (doesn't make sense, but when you're desperate, you'll try anything...)
 
Old 08-06-2004, 08:38 AM   #11
jdelaros1
LQ Newbie
 
Registered: Sep 2003
Location: Austin, TX USA
Distribution: Fedora 1.0, 2.0 & SuSE 9.2
Posts: 20

Rep: Reputation: 0
I forgot to mention: How about using a newer kernel? You're running an old version, this could be an issue. Try a new kernel so you can rule out that possibility.

Have you tried iptables instead of ipchains? You did mention that when you turned off the firewall things seemed to work ok. Is the squid version you're using fairly new? It could have some issues with ipchains.
 
Old 08-06-2004, 09:23 AM   #12
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
I am not sure it is a kernel issue. I had configured a similar setup, minus the VPN, while RH6.2 was in vogue. And everything held on fine.
Quote:
If I remove access for the machines in ACL Squid, I am getting the page - Squid's Access Denied in the machines.
Is this with the filters (firewall) on or off?
Quote:
if I turn off firewall all machines are able to browse with the appropriate access in Squid ACL.

Please post the tcpdumps too - for 192.168.1.1 and another system, say 1.3 -
at the proxy machine and at the source (1.1 and 1.3) - with the firewall running and without.


Last edited by ppuru; 08-06-2004 at 09:41 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange C program issue exvor Programming 21 07-06-2005 07:42 PM
strange c issue exvor Programming 8 01-29-2005 02:23 PM
help me on a strange issue. newpenguin Linux - General 11 10-06-2002 03:42 PM
Network Packet Filter vs ipchains Nephlite Linux - Networking 1 02-04-2002 03:16 AM
ipchains & dhcp for internal network jmelgin Linux - Security 1 10-15-2001 08:29 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:34 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration