From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?Q?Juli=E1n_Mar=EDa_M=FCller_Frizza?= Subject: 2 LANs in SERVER + 2 xDSL (pppOe) accounts. MASQUERADE both lans! Date: Sat, 23 Aug 2003 05:37:44 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004801c36951$d2b01b50$e800a8c0@tecnico> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="Boundary_(ID_m0RQjZxQVFSwCL7YxH6fLA)" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. --Boundary_(ID_m0RQjZxQVFSwCL7YxH6fLA) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: quoted-printable The problem is describe here people: = http://www.experts-exchange.com/Networking/Linux_Networking/Q_20680648.ht= ml But I will explain it again.=20 I have RED HAT 9 with 4 eths And: Two pppOE conections (2 xDSL accounts each one with his own eth) & Two = LANS (2 more eths) I want to masquerade LAN1 (eth0) to use ppp0 and masquerade LAN2 (eth2) to use ppp1 So is this: HOW route 1 ppp to 1 LAN and the other ppp conection to LAN = 2 LAN1 is 192.168.0.0 ---> to 192.168.0.1 (eth0) LAN2 is 192.168.1.0 ---> to 192.168.1.1 (eth2) I created both ppp xDSL accounts with adsl-setup (when creating the ifcfg-ppp0 and ifcfg-ppp1 files, the setup = automatically gave both accounts the same PID FILE, so ONLY one can be = enabled at a given time. I change ifcfg-ppp1 PID FILE name and now I can enabled BOTH AT THE SAME = TIME. BUT IS THIS CORRECT? when I do route -n I have this: GATEWAY 192.168.96.240 0.0.0.0 255.255.255.255 UH 0 0 = 0 ppp0 192.168.96.240 0.0.0.0 255.255.255.255 UH 0 0 = 0 ppp1 10.0.0.0 0.0.0.0 255.255.255.0 U 0 = 0 0 eth3 10.0.0.0 0.0.0.0 255.255.255.0 U 0 = 0 0 eth3 192.168.1.0 0.0.0.0 255.255.255.0 U 0 = 0 0 eth2 192.168.0.0 0.0.0.0 255.255.255.0 U 0 = 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 = 0 0 eth3 127.0.0.0 0.0.0.0 255.0.0.0 U = 0 0 0 lo 0.0.0.0 192.168.96.240 0.0.0.0 UG 0 = 0 0 ppp0 Only one ppp0 is the default gateway. But well. Tell me if configuring manually (changing pid file name in ppp1 script) = is correct Then: I used graffix quicktables script to crate the rc.firewall = (iptables script) The script was this: ------------------------------------------------------------------ # path to iptables iptables=3D"/sbin/iptables" if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then echo 1 > = /proc/sys/net/ipv4/tcp_syncookies; fi if [ -e /proc/sys/net/ipv4/ip_forward ]; then echo 1 > = /proc/sys/net/ipv4/ip_forward; fi # DEFAULT=20 $iptables -F INPUT $iptables -F OUTPUT $iptables -P INPUT DROP $iptables -P OUTPUT ACCEPT # NAT $iptables -F FORWARD $iptables -F -t nat $iptables -P FORWARD DROP $iptables -A FORWARD -i eth0 -j ACCEPT $iptables -A INPUT -i eth0 -j ACCEPT $iptables -A OUTPUT -o eth0 -j ACCEPT $iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE # allow all packets on the loopback interface $iptables -A INPUT -i lo -j ACCEPT $iptables -A OUTPUT -o lo -j ACCEPT # allow established and related packets back in $iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j = ACCEPT # icmp $iptables -A OUTPUT -p icmp -m state --state NEW -j ACCEPT $iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j = ACCEPT $iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s = -i ppp0 -j ACCEPT # open ports to the firewall $iptables -A INPUT -p tcp --dport 21 -j ACCEPT $iptables -A INPUT -p tcp --dport 80 -j ACCEPT $iptables -A INPUT -p tcp --dport 25 -j ACCEPT $iptables -A INPUT -p tcp --dport 23 -j ACCEPT $iptables -A INPUT -p tcp --dport 100 -j ACCEPT $iptables -A INPUT -p tcp --dport 110 -j ACCEPT $iptables -A INPUT -p tcp --dport 81 -j ACCEPT $iptables -A INPUT -p tcp --dport 27015 -j ACCEPT $iptables -A INPUT -p tcp --dport 27016 -j ACCEPT /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT /sbin/iptables -A INPUT -p udp --dport 514 -j ACCEPT =20 # drop all other packets $iptables -A INPUT -i ppp0 -p tcp --dport 0:65535 -j DROP $iptables -A INPUT -i ppp0 -p udp --dport 0:65535 -j DROP -------------------------------------------------------------------------= --------- Then to make what I want (masquerade both lans and that lan1 use ppp0, = and lan2 use ppp1) patch and recompile kernel with ROUTE patch of = C=E9dric de Launois http://www.netfilter.org/documentation/pomlist/pom-extra.html#ROUTE Well. after compiling kernel and test that ROUTE patch was OK. I modify = rc.firewall script BUT didn't function. (may be i did a wrong script = rc.firewall manually) The second LAN (eth2) ---> ppp1 dont reach internet. So. WHat should I do? :)= --Boundary_(ID_m0RQjZxQVFSwCL7YxH6fLA) Content-type: text/html; charset=iso-8859-1 Content-transfer-encoding: quoted-printable
But I will explain it again. =
 
I have RED HAT 9 with 4 = eths
And:
Two pppOE conections (2 xDSL accounts each one with his own eth) = & Two=20 LANS (2 more eths)
I want to masquerade LAN1 (eth0) to use = ppp0
and masquerade LAN2 (eth2) to use = ppp1
 
So is this: HOW route 1 ppp to 1 LAN and the other ppp = conection=20 to LAN 2
LAN1 is 192.168.0.0 ---> to = 192.168.0.1=20 (eth0)
LAN2 is 192.168.1.0 ---> to = 192.168.1.1=20 (eth2)

 
I created both ppp xDSL accounts with=20 adsl-setup
(when creating the ifcfg-ppp0 and = ifcfg-ppp1 files,=20 the setup automatically gave both accounts the same PID FILE, so ONLY = one can be=20 enabled at a given time.
I change ifcfg-ppp1 PID FILE name and = now I can=20 enabled BOTH AT THE SAME TIME. BUT IS THIS CORRECT?
 
when I do route -n I have = this:
 
 
       =20             =    =20         GATEWAY
192.168.96.240      0.0.0.0     =    =20 255.255.255.255 UH    0      0     =  =20  0 ppp0
192.168.96.240      0.0.0.0   =  =20     255.255.255.255 UH    0      0 =  =20      0=20 ppp1
10.0.0.0         &nb= sp;        0.0.0.0=20         255.255.255.0        U =  =20   0      0        0=20 eth3
10.0.0.0         &nb= sp;        0.0.0.0=20         255.255.255.0        U =  =20   0      0        0=20 eth3
192.168.1.0        =    =20 0.0.0.0         255.255.255.0 =  =20      U     0      0   =    =20  0 eth2
192.168.0.0        =20 0.0.0.0            = 255.255.255.0=20        U     0      0 =    =20    0 eth0
169.254.0.0        =20 0.0.0.0            = 255.255.0.0=20             U     0   =  =20  0        0 eth3
127.0.0.0     =  =20        0.0.0.0       =20     255.0.0.0             =  =20   U     0      0       =  0=20 lo
0.0.0.0         192.168.96.240  0.0.0.0 =  =20                  UG   =  0=20      0        0 ppp0
Only one ppp0 is the default = gateway.
 
But well.
Tell me if configuring manually = (changing pid file=20 name in ppp1 script) is correct
 
Then: I used graffix quicktables script = to crate=20 the rc.firewall (iptables script)
 
The script was this:
 
 
----------------------------------------------------------------= --
# path to iptables
iptables=3D"/sbin/iptables"

if [ -e=20 /proc/sys/net/ipv4/tcp_syncookies ]; then echo 1 >=20 /proc/sys/net/ipv4/tcp_syncookies; fi
if [ -e = /proc/sys/net/ipv4/ip_forward=20 ]; then echo 1 > /proc/sys/net/ipv4/ip_forward; fi

# DEFAULT=20
$iptables -F INPUT
$iptables -F OUTPUT
$iptables -P INPUT=20 DROP
$iptables -P OUTPUT ACCEPT

# NAT
$iptables -F=20 FORWARD
$iptables -F -t nat
$iptables -P FORWARD DROP
$iptables = -A=20 FORWARD -i eth0 -j ACCEPT
$iptables -A INPUT -i eth0 -j = ACCEPT
$iptables=20 -A OUTPUT -o eth0 -j ACCEPT
$iptables -A FORWARD -m state --state=20 ESTABLISHED,RELATED -j ACCEPT
$iptables -t nat -A POSTROUTING -s=20 192.168.0.0/24 -o ppp0 -j MASQUERADE

# allow all packets on the = loopback=20 interface
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT = -o lo -j=20 ACCEPT

# allow established and related packets back = in
$iptables -A=20 INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#=20 icmp
$iptables -A OUTPUT -p icmp -m state --state NEW -j = ACCEPT
$iptables=20 -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j = ACCEPT
$iptables -A=20 INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -i ppp0 -j=20 ACCEPT

# open ports to the firewall
$iptables -A INPUT -p tcp = --dport=20 21 -j ACCEPT
$iptables -A INPUT -p tcp --dport 80 -j = ACCEPT
$iptables -A=20 INPUT -p tcp --dport 25 -j ACCEPT
$iptables -A INPUT -p tcp --dport = 23 -j=20 ACCEPT
$iptables -A INPUT -p tcp --dport 100 -j ACCEPT
$iptables = -A INPUT=20 -p tcp --dport 110 -j ACCEPT
$iptables -A INPUT -p tcp --dport 81 -j=20 ACCEPT
$iptables -A INPUT -p tcp --dport 27015 -j ACCEPT
$iptables = -A=20 INPUT -p tcp --dport 27016 -j ACCEPT
/sbin/iptables -A INPUT -p udp = --dport=20 53 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 514 -j=20 ACCEPT

 
# drop all other packets
$iptables -A INPUT = -i ppp0=20 -p tcp --dport 0:65535 -j DROP

$iptables -A INPUT -i ppp0 -p udp = --dport=20 0:65535 -j DROP
----------------------------------------------------------------= ------------------
 
Then to make what I want (masquerade = both lans and=20 that lan1 use ppp0, and lan2 use ppp1) patch and recompile kernel with = ROUTE=20 patch of C=E9dric de Launois
http://www.netfilter.org/documentation/pomlist/pom-extra.html#ROUTE
 
 
Well. after compiling kernel and test = that ROUTE=20 patch was OK. I modify rc.firewall script BUT didn't function. (may be i = did a=20 wrong script rc.firewall manually)
The second LAN (eth2) ---> ppp1 dont = reach=20 internet.
 
So. WHat should I do?
 
:)
--Boundary_(ID_m0RQjZxQVFSwCL7YxH6fLA)--