dnsmasq problem, nat not working

tank728 · 01-10-2005, 09:22 PM

How it is going fellas? Unfortunately no so well for me. I want to upgrade my linksys router to a full time slack router. So let me lay it down for you. I have my cable modem plug into eth0, and i am getting a public ip (I am writing this post from the box now). eth1 is plugin to my network, and is statically assigned 192.168.0.1. All of my clients are getting an private ip, with in the range set forth in my /etc/dnsmasq.conf file. When I ping gw (192.168.0.1) it works, but when I ping google, i get time out, but included with the output of ping is the ip address of google, so that rules out dns. I get the feeling that I have to open up port 80 with iptables, but I am not sure if that is the proble, because I do not know a lot about using iptables. I have also started /etc/rc.d/rc.ip_forward. I will be glad to post any config file you request. Thanks alot fellas

-tank

davidsrsb · 01-10-2005, 09:55 PM

Why use Slackware as a firewall? IPCop and M0n0wall are far more optimised.

tank728 · 01-10-2005, 10:08 PM

I understand your point, but I would like to house some other things on this box as well: ftp, ssh, samba (network drive), cups (network printer), and squid. But this is all in due time.

-tank

soylentgreen · 01-10-2005, 10:32 PM

in
/etc/resolv.conf
add

nameserver = X.X.X.X
if you have dnsmasq setup on 192.168.0.1 then its that after the '='

soylentgreen · 01-10-2005, 10:33 PM

and i love my slackware router...

soylentgreen · 01-10-2005, 10:35 PM

DRAT!!!

ok.. i don't know how to edit my post...

its not
'nameserver = 192.168.0.1'
it's
'nameserver 192.168.0.1'

sorry...
really.. i'm sorry.

tank728 · 01-10-2005, 10:44 PM

Not quite sure of your post (posts

, but yes dnsmasq is running on 192.168.0.1 (eth1). My /etc/resolv.conf looks like this, on my slack router.

Code:

nameserver 167.206.3.224
nameserver 167.206.3.223
nameserver 167.206.3.158

Those would be from my isp.

client /etc/resolv.conf

Code:

nameserver 192.168.0.1

I have tried adding my routers resovl.conf to my client, but no dice.

-tank

tank728 · 01-11-2005, 01:40 PM

I would like to thank you guys for you help, but I have a one other
question. Using iptables, how do I block specific ports on a
specific network cards? I want to set up samba and cups, but I do
not want the Internet to have them. For example I want to block
port 631 on eth0 (connect to my modem) and keep it open on eth1,
so my network will have access. Can I define this in cupsd.conf. With
samba, I believe in the [global] section you can add "interfaces = ethX"
and it will only broadcast on those specified nics. Thanks alot.

-tank

soylentgreen · 01-11-2005, 11:37 PM

did you get everything working??

i have a completely slackware network.. and i swear i'll try to be more lucid in my next posts..

please let me know if anything isn't doing anything.

zhjim · 05-26-2006, 05:15 PM

Regarding you iptables question. You should normaly block everything with setting the policies and only allowed specific ports to be open. Something like

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

to have everything dropped coming from (output), to (INPUT) and through (FORWARD) your box. And then allow special ports

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT

to allow all traffic from and to your homenetwork.

check out the man page of iptables or take a look at

http://sourceforge.net/search/?type_...omeLanSecurity