* Masquerade don't masquerade
@ 2004-08-25 19:05 Mardaga Stephan
2004-08-25 19:18 ` George Alexandru Dragoi
0 siblings, 1 reply; 6+ messages in thread
From: Mardaga Stephan @ 2004-08-25 19:05 UTC (permalink / raw)
To: netfilter
Hello,
I'm new on this forum and hope you will help me.
I'm building a Debian server and it is the basic stage.
I wish to run Iptables with masquerade.
detailed problem report could be find @ this address :
http://homeusers.brutele.be/smardaga/masquerade/
resume :
PC1 Debian Serveur PC2
| Eth0 Eth1 |
|.1 .50| |.1 .2|
| | | |
| | | |
--------------------------- -------------------------
192.168.0.x/24 192.168.1.x/24
Masquerade don't work when pinging from PC2 (192.168.1.2) to PC1
(192.168.0.1). PC1 receives icmp packet with IP source address 192.168.1.2.
tcpdump on eth0 :
20:30:25.472725 192.168.1.2 > 192.168.0.1: icmp: echo request
20:30:30.972679 192.168.1.2 > 192.168.0.1: icmp: echo request
20:30:36.472321 192.168.1.2 > 192.168.0.1: icmp: echo request
20:30:41.972217 192.168.1.2 > 192.168.0.1: icmp: echo request
20:30:47.472049 192.168.1.2 > 192.168.0.1: icmp: echo request
20:30:52.972084 192.168.1.2 > 192.168.0.1: icmp: echo request
iptables release 1.2.6a
Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
LOG all -- anywhere anywhere LOG level
warning
MASQUERADE all -- 192.168.1.0/24 anywhere
LOG all -- anywhere anywhere LOG level
warning
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Any help and/or suggestions will be accepted gratefully.
Thanks in advance,
Stephan Mardaga
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Masquerade don't masquerade
2004-08-25 19:05 Mardaga Stephan
@ 2004-08-25 19:18 ` George Alexandru Dragoi
2004-08-25 19:36 ` Mardaga Stephan
0 siblings, 1 reply; 6+ messages in thread
From: George Alexandru Dragoi @ 2004-08-25 19:18 UTC (permalink / raw)
To: netfilter
The -L output is not enough,
try iptables-save -t nat
Also make sure you don't filter stuff in -t filter chain FORWARD
And, did you echo 1 > /proc/sys/net/ipv4/ip_forward ? :D
On Wed, 25 Aug 2004 21:05:07 +0200, Mardaga Stephan <smardaga@brutele.be> wrote:
> Hello,
>
> I'm new on this forum and hope you will help me.
>
> I'm building a Debian server and it is the basic stage.
> I wish to run Iptables with masquerade.
>
> detailed problem report could be find @ this address :
> http://homeusers.brutele.be/smardaga/masquerade/
>
> resume :
>
> PC1 Debian Serveur PC2
> | Eth0 Eth1 |
> |.1 .50| |.1 .2|
> | | | |
> | | | |
> --------------------------- -------------------------
> 192.168.0.x/24 192.168.1.x/24
>
> Masquerade don't work when pinging from PC2 (192.168.1.2) to PC1
> (192.168.0.1). PC1 receives icmp packet with IP source address 192.168.1.2.
>
> tcpdump on eth0 :
>
> 20:30:25.472725 192.168.1.2 > 192.168.0.1: icmp: echo request
> 20:30:30.972679 192.168.1.2 > 192.168.0.1: icmp: echo request
> 20:30:36.472321 192.168.1.2 > 192.168.0.1: icmp: echo request
> 20:30:41.972217 192.168.1.2 > 192.168.0.1: icmp: echo request
> 20:30:47.472049 192.168.1.2 > 192.168.0.1: icmp: echo request
> 20:30:52.972084 192.168.1.2 > 192.168.0.1: icmp: echo request
>
> iptables release 1.2.6a
> Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
>
> Chain PREROUTING (policy ACCEPT)
> target prot opt source destination
>
> Chain POSTROUTING (policy ACCEPT)
> target prot opt source destination
> LOG all -- anywhere anywhere LOG level
> warning
> MASQUERADE all -- 192.168.1.0/24 anywhere
> LOG all -- anywhere anywhere LOG level
> warning
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> Any help and/or suggestions will be accepted gratefully.
>
> Thanks in advance,
>
> Stephan Mardaga
>
>
--
Bla bla
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Masquerade don't masquerade
@ 2004-08-25 19:18 Jason Opperisano
2004-08-25 19:40 ` Mardaga Stephan
0 siblings, 1 reply; 6+ messages in thread
From: Jason Opperisano @ 2004-08-25 19:18 UTC (permalink / raw)
To: netfilter
> iptables release 1.2.6a
> Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
>
> Chain PREROUTING (policy ACCEPT)
> target prot opt source destination
>
> Chain POSTROUTING (policy ACCEPT)
> target prot opt source destination
> LOG all -- anywhere anywhere LOG level
> warning
> MASQUERADE all -- 192.168.1.0/24 anywhere
> LOG all -- anywhere anywhere LOG level
> warning
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> Any help and/or suggestions will be accepted gratefully.
blind gues would be that you have the wrong interface specified in your MASQUERADE rule. can you post the output of "iptables -t nat -vnL" instead of just "-nL" so we can see the in/out interfaces.
-j
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Masquerade don't masquerade
2004-08-25 19:18 ` George Alexandru Dragoi
@ 2004-08-25 19:36 ` Mardaga Stephan
0 siblings, 0 replies; 6+ messages in thread
From: Mardaga Stephan @ 2004-08-25 19:36 UTC (permalink / raw)
To: netfilter
Here are :
> The -L output is not enough,
> try iptables-save -t nat
# Generated by iptables-save v1.2.6a on Wed Aug 25 21:28:05 2004
*nat
:PREROUTING ACCEPT [631:81365]
:POSTROUTING ACCEPT [60:18132]
:OUTPUT ACCEPT [60:18132]
-A POSTROUTING -j LOG
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -o eth0 -j MASQUERADE
-A POSTROUTING -j LOG
COMMIT
# Completed on Wed Aug 25 21:28:05 2004
> Also make sure you don't filter stuff in -t filter chain FORWARD
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
> And, did you echo 1 > /proc/sys/net/ipv4/ip_forward ? :D
yes
>
> On Wed, 25 Aug 2004 21:05:07 +0200, Mardaga Stephan <smardaga@brutele.be>
wrote:
> > Hello,
> >
> > I'm new on this forum and hope you will help me.
> >
> > I'm building a Debian server and it is the basic stage.
> > I wish to run Iptables with masquerade.
> >
> > detailed problem report could be find @ this address :
> > http://homeusers.brutele.be/smardaga/masquerade/
> >
> > resume :
> >
> > PC1 Debian Serveur PC2
> > | Eth0 Eth1 |
> > |.1 .50| |.1 .2|
> > | | | |
> > | | | |
> > --------------------------- -------------------------
> > 192.168.0.x/24 192.168.1.x/24
> >
> > Masquerade don't work when pinging from PC2 (192.168.1.2) to PC1
> > (192.168.0.1). PC1 receives icmp packet with IP source address
192.168.1.2.
> >
> > tcpdump on eth0 :
> >
> > 20:30:25.472725 192.168.1.2 > 192.168.0.1: icmp: echo request
> > 20:30:30.972679 192.168.1.2 > 192.168.0.1: icmp: echo request
> > 20:30:36.472321 192.168.1.2 > 192.168.0.1: icmp: echo request
> > 20:30:41.972217 192.168.1.2 > 192.168.0.1: icmp: echo request
> > 20:30:47.472049 192.168.1.2 > 192.168.0.1: icmp: echo request
> > 20:30:52.972084 192.168.1.2 > 192.168.0.1: icmp: echo request
> >
> > iptables release 1.2.6a
> > Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
> >
> > Chain PREROUTING (policy ACCEPT)
> > target prot opt source destination
> >
> > Chain POSTROUTING (policy ACCEPT)
> > target prot opt source destination
> > LOG all -- anywhere anywhere LOG level
> > warning
> > MASQUERADE all -- 192.168.1.0/24 anywhere
> > LOG all -- anywhere anywhere LOG level
> > warning
> >
> > Chain OUTPUT (policy ACCEPT)
> > target prot opt source destination
> >
> > Any help and/or suggestions will be accepted gratefully.
> >
> > Thanks in advance,
> >
> > Stephan Mardaga
> >
> >
>
>
> --
> Bla bla
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Masquerade don't masquerade
2004-08-25 19:18 Masquerade don't masquerade Jason Opperisano
@ 2004-08-25 19:40 ` Mardaga Stephan
2004-08-29 11:47 ` Mardaga Stephan
0 siblings, 1 reply; 6+ messages in thread
From: Mardaga Stephan @ 2004-08-25 19:40 UTC (permalink / raw)
To: netfilter
From: "Jason Opperisano" <Jopperisano@alphanumeric.com>
> iptables release 1.2.6a
> Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
>
> Chain PREROUTING (policy ACCEPT)
> target prot opt source destination
>
> Chain POSTROUTING (policy ACCEPT)
> target prot opt source destination
> LOG all -- anywhere anywhere LOG level
> warning
> MASQUERADE all -- 192.168.1.0/24 anywhere
> LOG all -- anywhere anywhere LOG level
> warning
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> Any help and/or suggestions will be accepted gratefully.
blind gues would be that you have the wrong interface specified in your
MASQUERADE rule. can you post the output of "iptables -t nat -vnL" instead
of just "-nL" so we can see the in/out interfaces.
here are :
Chain PREROUTING (policy ACCEPT 643 packets, 82862 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 61 packets, 18460 bytes)
pkts bytes target prot opt in out source
destination
55 16492 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4
0 0 MASQUERADE all -- * eth0 192.168.1.0/24
0.0.0.0/0
55 16492 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4
Chain OUTPUT (policy ACCEPT 61 packets, 18460 bytes)
pkts bytes target prot opt in out source
destination
Stef
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Masquerade don't masquerade
2004-08-25 19:40 ` Mardaga Stephan
@ 2004-08-29 11:47 ` Mardaga Stephan
0 siblings, 0 replies; 6+ messages in thread
From: Mardaga Stephan @ 2004-08-29 11:47 UTC (permalink / raw)
To: netfilter
Masquerade is working now.
The rule is to stop networking beforee changes to nat iptables and after
networking start.
This rule don't need to be applied for tthee filter iptables.
Thanks everyone for the help.
Stephan
----- Original Message -----
From: "Mardaga Stephan" <smardaga@brutele.be>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, August 25, 2004 9:40 PM
Subject: Re: Masquerade don't masquerade
> From: "Jason Opperisano" <Jopperisano@alphanumeric.com>
>
>
> > iptables release 1.2.6a
> > Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown
> >
> > Chain PREROUTING (policy ACCEPT)
> > target prot opt source destination
> >
> > Chain POSTROUTING (policy ACCEPT)
> > target prot opt source destination
> > LOG all -- anywhere anywhere LOG level
> > warning
> > MASQUERADE all -- 192.168.1.0/24 anywhere
> > LOG all -- anywhere anywhere LOG level
> > warning
> >
> > Chain OUTPUT (policy ACCEPT)
> > target prot opt source destination
> >
> > Any help and/or suggestions will be accepted gratefully.
>
> blind gues would be that you have the wrong interface specified in your
> MASQUERADE rule. can you post the output of "iptables -t nat -vnL"
instead
> of just "-nL" so we can see the in/out interfaces.
>
> here are :
>
> Chain PREROUTING (policy ACCEPT 643 packets, 82862 bytes)
> pkts bytes target prot opt in out source
> destination
>
> Chain POSTROUTING (policy ACCEPT 61 packets, 18460 bytes)
> pkts bytes target prot opt in out source
> destination
> 55 16492 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 4
> 0 0 MASQUERADE all -- * eth0 192.168.1.0/24
> 0.0.0.0/0
> 55 16492 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 4
>
> Chain OUTPUT (policy ACCEPT 61 packets, 18460 bytes)
> pkts bytes target prot opt in out source
> destination
>
> Stef
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-08-29 11:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-08-25 19:18 Masquerade don't masquerade Jason Opperisano
2004-08-25 19:40 ` Mardaga Stephan
2004-08-29 11:47 ` Mardaga Stephan
-- strict thread matches above, loose matches on Subject: below --
2004-08-25 19:05 Mardaga Stephan
2004-08-25 19:18 ` George Alexandru Dragoi
2004-08-25 19:36 ` Mardaga Stephan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.