LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 06-12-2007, 06:16 AM   #1
Techno T
LQ Newbie
 
Registered: May 2007
Posts: 10

Rep: Reputation: 0
Angry Xp-host can't access internet through my Fedora box??


EthO is for my ISP (DHCP)
Eth1 is for my internal network.

I can ping both machines and the Linux machine can access the XP box and the internet, but if I try to connect to the internet on the Xp-Machine it will not do it. I also can't ping the DNS-Servers of my ISP from the Xp-Machine.

In my start-up script I have included the following for Internet sharing;

# Net Sharing
/sbin/modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -j LOG --log-level 4 --log-prefix "ATTACK"
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE

And have also added ./rc.firewall to my rc.local file.

Any suggestions would be appreciated!!
 
Old 06-12-2007, 01:03 PM   #2
sandgroper
Member
 
Registered: Jul 2004
Location: Perth , Western Australia
Distribution: Fedora Core 5 , Mint 9
Posts: 118

Rep: Reputation: 15
Smile

Quote:
Originally Posted by Techno T
EthO is for my ISP (DHCP)
Eth1 is for my internal network.

I can ping both machines and the Linux machine can access the XP box and the internet, but if I try to connect to the internet on the Xp-Machine it will not do it. I also can't ping the DNS-Servers of my ISP from the Xp-Machine.

In my start-up script I have included the following for Internet sharing;

# Net Sharing
/sbin/modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -j LOG --log-level 4 --log-prefix "ATTACK"
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE

And have also added ./rc.firewall to my rc.local file.

Any suggestions would be appreciated!!
What you have really done is to just set up the masquerading , you will also need to add some forwarding rules to forward packets to/from your XP box.

I think you will need something like this :

Code:
#------------------------reset iptables ---------------------------
iptables -F
iptables -X

#------------------------local loopback-----------------------------------

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# --------------- masquerading and forwarding of packets--------------------
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/24 -j DROP
iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.0/24
.
 
Old 06-13-2007, 01:39 AM   #3
Techno T
LQ Newbie
 
Registered: May 2007
Posts: 10

Original Poster
Rep: Reputation: 0
Thanks I deleted the script and booted up and the problem is still there even with the firewall turned off the problem is still the same. It’s something more basic and certainly should not be that hard to fix, strange can’t quite work what it could be.
 
Old 06-13-2007, 02:27 AM   #4
sandgroper
Member
 
Registered: Jul 2004
Location: Perth , Western Australia
Distribution: Fedora Core 5 , Mint 9
Posts: 118

Rep: Reputation: 15
Quote:
Originally Posted by Techno T
Thanks I deleted the script and booted up and the problem is still there even with the firewall turned off the problem is still the same. It’s something more basic and certainly should not be that hard to fix, strange can’t quite work what it could be.
Firstly did you delete the existing chains from iptables ?
Do a iptables -nL to check of what the current rules are set to.

Also run this script to reset the iptables back to the default values

Code:
# !/bin/bash
# script to flush firewall

# flush all tables
iptables -F
iptables -X
iptables -t nat -X

# reset default policies on filter table
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# reset default policies on nat table
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
echo
iptables -nL
Also to set the IPV4 forwarding to permanent , edit the /etc/sysctl.conf and add the line
net.ipv4.ip_forward = 1
( it will already be there , just change the 0 to 1 )

You may just have some basic problem when implimenting your iptables , part of the problem is to work out the logic for what you want to do with the packets.
Here is a tutorial about iptables , it is fairly long and detailed but it is worth a read.

Iptables Tutorial 1.2.2


.
 
Old 06-13-2007, 05:13 AM   #5
Techno T
LQ Newbie
 
Registered: May 2007
Posts: 10

Original Poster
Rep: Reputation: 0
Thx Sandgroper,

I did all the things you suggested, but unfortunately no change in the situation. It just does not want to play. Looks like I have to dive into the books again.
 
Old 06-13-2007, 06:49 AM   #6
hhvv
Member
 
Registered: May 2006
Location: India
Distribution: RHEL,CentOS,BSD,Ubuntu
Posts: 59
Blog Entries: 1

Rep: Reputation: 15
Try these fairly simple rules

iptables -A FORWARD -p tcp -i eth1 -s <IP_of_XP>/24 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s <IP_Range_of_XP>/24 -j DROP
iptables -A FORWARD -p tcp -i eth1 -s 0.0.0.0/0 -j DROP

iptables -A PREROUTING -o eth0 -j MASQUERADE
 
Old 06-14-2007, 01:25 PM   #7
ajaimes
Member
 
Registered: Dec 2004
Distribution: Ubuntu
Posts: 34

Rep: Reputation: 15
are you allowing ip forwarding?

echo 1 > /proc/sys/net/ipv4/ip_forward
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Host Unreachable , ICS, Slackware Box=Client, XP Box=host MercuryRising Linux - Networking 5 04-13-2006 02:52 PM
Sharing internet access with my Windows box ColdDeath Slackware 5 11-02-2005 04:08 PM
internet host access problem linetnew Linux - Networking 5 10-03-2005 03:15 PM
Access Mandrake box from Fedora Core 1 box btexpress Linux - Networking 0 05-30-2004 08:50 PM
HELP ME!!! Can ping my sever box but can't access the internet elkrammer Linux - Networking 1 08-03-2002 11:15 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:05 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration