Redhat as a router not working
 

Hi though I have configured net.ipv4.ip_forward=1 and firewall is down, I am unable to route via this machine. There are no issue If I try to access sourc and the destination from the router.

I am running Redhat 5.3 and 2 x NICs

Thanks and Best Regards

Hi

Could you display your ip settings/ sysctl.conf file ?

You'll have to configure the route. Did you do that? please post the ouput of the commandMarkus

Hi Guys thank you for the replies below are the details you requested

IP settings

# VIA Technologies, Inc. VT6105/VT6106S [Rhine-III]
DEVICE=eth0
BOOTPROTO=none
HWADDR=00:1E:58:A7:6F:11
IPV6INIT=no
IPV6_AUTOCONF=no
ONBOOT=yes
TYPE=Ethernet
PEERDNS=yes
USERCTL=no
NETMASK=255.255.255.0
IPADDR=192.168.11.73

# Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+
DEVICE=eth1
BOOTPROTO=static
HWADDR=00:C0:26:2E:BC:BD
ONBOOT=yes
TYPE=Ethernet
USERCTL=no
IPV6INIT=no
PEERDNS=yes
IPADDR=192.168.1.250
NETMASK=255.255.255.0
GATEWAY=192.168.1.1

sysctl.comf

# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename
# Useful for debugging multi-threaded applications
kernel.core_uses_pid = 1

# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1

# Controls the maximum size of a message, in bytes
kernel.msgmnb = 65536

# Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536

# Controls the maximum shared segment size, in bytes
kernel.shmmax = 4294967295

# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 268435456

kernel.hostname = sysgate
kernel.domainname = iil.informatics.lk


Route -n

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
192.168.11.0 * 255.255.255.0 U 0 0 0 eth0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth1


Thanks and Regards

Well, I'm not an expert. But when I configure my laptop as wireless accesspoint, its gateway and ip adress are the same.

Do you use DHCP? which ip settings do the clients in your 192.168.1.0/24 network have? Could you please check the output of ifconfig on any client?

Markus

Hi Markush,

192.168.11.0 range is the client side and 192.168.1.0 range is internal connection to a leased line router and its IP is 192.168.1.1. So what I want to do the what ever the traffic comes to eth0 (192.168.11.73) should be routed to 192.168.1.1

Thanks and Best Regards

Ah, yes, I didn't understand you setup correctly.

Markus

No worries Markush, I dont understand every thing seems to be working fine, I can reach both ip ranges from the router to be machine but it just refuse to route

So you're trying to configure this host as a router? If so, you will probably want to use iptables, and a host of rules to forward traffic between the two interfaces. What is the use case for your desired router: home network, routing between subnets on a LAN, other? There are commonly packages or tools to assist in creating an appropriate set of rules, and I suggest using them, unless you have significant expertise in creating routers or other networking devices using Linux.

--- rod.

Have you already ran these below commands?
Just change $INTERNET_INTERFACE & $LAN_INTERFACE as eth1 or eth0 according your settings and also see how to setup Linux as a router.

Hi Guys, so just enabling net.ipv4.ip_forward is not enough is it? I need to configure iptables as well to start the IP forwarding? I though otherwise, you just have to enable net.ipv4.ip_forward to get a basic route going for starters

Thanks and Regards

does this help:
http://www.linuxquestions.org/questi...6/#post3804866

Hi Thanks you all for the replies, so conclution as per all the documentation I need to configure Firewall to forward packets and just by enabling net.ipv4.ip_forward will not work?

Let me try this and get back to you

Thanks and Best Regards

Your question casts some confusion. The 'route' command is not really related to the concept of using the host as a router. Setting routes is used to tell the IP stack how to send packets from the host, on an appropriate interface and/or to an appropriate gateway. Using the host as a router/firewall is a separate matter, and uses iptables rules (lots of them for a well configured setup) to configure appropriate routing of traffic between LANs or LANs and WAN. The central difference has to do with where the data originates: either on the host itself, or on some other host & requiring traversal of the router to a host on a different network.
You really need to explain what your objective is (just setting up routes, or configuring the host as a router), so people can answer accordingly. I see answers here that seem to touch on both sides.
--- rod.

Hi theNbomr, thank you for the explanation. my senario is as below

I have tow sub-nets one is 192.168.11.0 and the other is 192.168.1.0 can I use Redhat linux box to route packets between these two networks without having to configure firewall (host as a router)

Since I did the above just a linux box with 2 network interfaces, facing 11 and 1 ranges. I have enabled net.ipv4.ip_forward = 1 and added its default gate way as 192.168.1.1 since this is yet another router facing the internet. Since 11 and 1 ranges are known to the router I dont think I have to add any specific route to routing table. And the firewall is off

My problem is when I try to ping 192.168.1.1 (internet route) from 192.168.11.120 (client in 11 range and its gateway is set to 192.168.11.254 (linux box which I am trying to configure as router)) I get a time out. If I to do a traceroute to 192.168.1.1 it will go up to 192.168.11.254 and stops with *****. But I can ping from the route to be to any machine on 11 rang and 192.168.1.1 route

I dont understand what I going on. as per help I got it looks like I need firewall as well to achieve my objective

Thanks and Regards

One thing about that "net.ipv4.ip_forward=1" - it applies to routable IPv4 networks. The two networks you are using are members of "192.168.xx.xx" networks, and these are NOT routable.

You CAN use iptables to route these, but it is usually (not always) done as part of NAT. NAT makes this easier in one direction (from "behind the NAT" to outside) but this imposes a NAT behind a NAT type of thing - doable, but a pain as it doesn't allow the middle network to access behind the lower level NAT.

And no, I haven't done such routing without using masquerading.

Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.


Thanks and Best Regards

You will need to configure iptables because you'll have to tell the router where the packages should go. Also you need NAT.

You should read more about iptables and understand that it is not only "the firewall" but also manages routing, or in other words, a firewall is nothing but "routingrules".

Markus

I believe that is what it is used for. The only IP numbers not routed would be the non-routable ones.

I think this is how the Quality of Service functions are handled by iptables. By default the only thing governing the routing are the specified routes set via the "route" utility.

When I was working, this function was normally handled by the Cisco (and other vendors) routers rather than by a host. So most of my experience with it was by NAT for isolating a test machine from a network, where the test machine was being targeted for use on another network. This allowed me to test everything as if the machine was in its targeted environment, without actually being in the target environment. Installation was a "drop in" and plug-it-in - taking only seconds to accomplish. I have replaced entire Kerberos environments with such a drop in without anyone noticing I had replaced the KDC. (I found it much safer to update the OS and Kerberos that way than the usual way of updating the backup... not good to have a "test" backup server when/if the primary fails for some reason.)

Okay, so now that we've established what problem we're chasing, I'm going to say that the solution is definitively not as simple as setting one or two kernel parameters (like net.ipv4.ip_forward = 1). A quality solution that covers all of the bases and does not leave security problems or maintenance problems involves quite a number of iptables rules, as well as sundry other settings. As someone correctly pointed out, a router and a firewall are really just two names for the same thing in this context.

procfs should use a tool made for the purpose of developing and deploying the correct collection of iptables rules. This may be in the form of GUI-based firewall creator, or a canned package of iptables rules and configurations as one or more shell scripts. These systems have been developed by people with significant expertise and experience, and have been used and refined by a cast of millions over a period of time. Having said this, I have no personal experience with the style of router that is needed here. Most or at least many packages for building firewalls/routers are geared toward the home or small business scenario, where the objective is to attach a local LAN to a single internet connection.

I'm not sure of the implications of routing between two local private networks, but I'm sure that there is a package that provides for configuration of LAN-LAN routing. I will leave it to others to suggest something. Meanwhile, it would be very very helpful if the OP could describe fully and unambiguously, the organization of the networks involved, the network interfaces of the router host, and what connectivity is desired, as well as what connectivity is to be prohibited.

--- rod.

It would actually be easier to make the Linux system a bridge between two segments of the same private network... I'm not sure, but it may be possible to define the bridge to use the network 192.168.0.0 network - and thus pass both subnets to the other side. It isn't a good solution as you may as well just use one private network instead.

Private networks were set aside specifically for use in test/development environments, to ensure that that network traffic NOT get broadcast. I have seen the 10.x.x.x private network used for large clusters... Routing between two such clusters is done using public IP numbers assigned to the public interfacing nodes. And you don't get arbitrary node from cluster a to node on cluster b connections.

Hi Guys, I was able to fix the problem "the system was not routing across networks" it was my fault not checking routing in our main Internet router "Simply there was no return path" when I add the route to the gateway router, pointing how to reach our privet 11 range things stared working :). Such a trivia thing, yet I failed to see :(. Now I need to setup the Iptabes and get the firewall going

Thank you all for helping me.

Thank you and Best Regards