Hi all

i am trying to set up a testing router so i can become familiar with iptables.
i have set up a PC running Debian Testing with 3 nics.

eth0 > IP: 192.168.0.150
Netmask: 255.255.248.0
Gateway: 192.168.0.1
/etc/resolv.conf is:
nameserver 192.168.1.150 (bind9 is installed)

eth1 > IP: 10.0.0.1
Netmask: 255.255.255.0
eth2 > IP: 11.0.0.1
Netmask: 255.255.255.0

i have issued "echo 1 > /proc/sys/net/ipv4/ip_forward" to enable routing also.

from the pc acting as the router i can ping and resolve addresses to everything on the network and also browse the internet. this is working great. i can ping all local ip addresses also. i also have bind9 installed to act as a DNS server for the clients on the 10.0.0.0 and 11.0.0.0 networks.

i have set up a pc to test the connection with the following ip configuration.

IP: 10.0.0.10
netmask: 255.255.255.0
gateway: 10.0.0.1

/etc/resolv.conf is set to:

nameserver 10.0.0.1

the client can ping all 3 ip addresses on the router, and can resolve outside world ip's. eg google

however i cannot ping 192.168.0.1 which is the gateway of the router nor any other ip within the 192.168.0.0 network. which means i cant get to the internet from my 10.0.0.0 and 11.0.0.0 networks.

i have flushed all iptables incase something might be getting in the way by "iptables -F"

i have been googling and searching for what i could be doing wrong for about 3 days. is there anything i may have missed?


Dale

Looks like, to me, that the gateway (192.168.0.1) doesnt know about your other 2 networks. It probably needs a route that says that the 10.0.0.0/24 network is reachable via the 192.168.0.150 machine, and also the same for the 11.0.0.0/24 network.

You packets are probably reaching their destination, but the return path is not know.

Try adding routes to the 192.168.0.1 router.

Hope this helps

the odd thing is that i had it working previously. without making any changes to the 192.168.0.1 firewall.

also as the connections are coming from 192.168.0.150 wouldn't that mean that 192.168.0.1 wouldn't need to know about those networks?

If the packets are just being routed, the firewall would need to know about those networks. Being just routed, the packets are forwarded, hence the connections would not be coming from the .150 machine. They would be coming from the 10. or 11. network.

Now, if the .150 machine was doing NAT, it would "rewrite" the packets to make them appear to come from the 150 host. In this case the firewall should not need to know about the other 2 networks behind the .150 host.

Hope this helps.

i was able to get it working with some help from a friend who mentioned trying this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

and that did the trick. on what docalton was saying, I'm assuming this masks the packets so that to any upstream route it looks like its coming directly from 192.168.0.150.