iptables set up

Pur 2103 · 07-30-2005, 12:51 PM

I would like to connect with my laptop (Windows XP) to the internet via my Linux PC (Fedora Core 4) I used the description at LinuxQuestions.org > LinuxAnswers > Linux Router (unfortunately I was not allowed to post the url

. When I now ping on the laptop yahoo.com I can see that it resolves the IP address but the respones times out. Same on Internet Explorer, I type in the web address, it resolves the ip address but get a cannot find server. What am I doing wrong?

Mara · 07-31-2005, 04:34 PM

Please show what you have in your routing table. Post result of the command 'route'.

Pur 2103 · 08-06-2005, 05:56 AM

here is the content of my /etc/sysconfig/iptables:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
filter
INPUT ACCEPT [0:0]
FORWARD ACCEPT [0:0]
OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

and here the result of /sbin/route:

[root@THOMAS sysconfig]# /sbin/route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
196.26.208.0 * 255.255.255.0 U 0 0 0 ippp0
default cas15-rba.dial- 0.0.0.0 UG 0 0 0 ippp0

thanks

Pur 2103 · 08-06-2005, 01:12 PM

Problem solved, found a very nice site http://www.yolinux.com/TUTORIALS/Lin...rkGateway.html and now my iptables looks like this

# Generated by iptables-save v1.3.0 on Sat Aug 6 20:09:02 2005
*nat
:OUTPUT ACCEPT [83:7653]
:POSTROUTING ACCEPT [10:763]
:PREROUTING ACCEPT [184:21265]
-A POSTROUTING -o ippp0 -j MASQUERADE
COMMIT
# Completed on Sat Aug 6 20:09:02 2005
# Generated by iptables-save v1.3.0 on Sat Aug 6 20:09:02 2005
*filter
:FORWARD ACCEPT [809:181954]
:INPUT ACCEPT [971:122582]
:OUTPUT ACCEPT [1049:83801]
-A FORWARD -i etho -j ACCEPT
COMMIT
# Completed on Sat Aug 6 20:09:02 2005

thanks for listening :-)

foo_bar_foo · 08-06-2005, 01:18 PM

lets see you put the address to the Linux machine as default gateway or whatever it is in windows tcp/ip settings

then here is a script that will turn on ip masquerading
adjust if your internet connection is not through ppp0 like mine (slow dialup)

Code:

#!/bin/bash

echo "setting up IPmasquerading......"

IPTABLES='/sbin/iptables'

#All The lines below are NAT routing

# flush any old rules
$IPTABLES -F -t nat

# turn on NAT (IP masquerading for outgoing packets)
$IPTABLES -A POSTROUTING -t nat -o ppp0 -j MASQUERADE

# enable IP forwarding (of incoming packets)
echo 1 > /proc/sys/net/ipv4/ip_forward