[LARTC] Re: routing problem with new subnet..

[LARTC] Re: routing problem with new subnet..

[Craig Reeson]

guys, i need some help with some problems I'm having

I have a debian (woody) box acting as router for my network and I am trying
to setup a dmz (210.xxx.xxx.225/29).

anyway, whenever a request comes in for one of the boxes in the dmz the
gateway box doesn't seem to answer any arp requests for it. So the
connection goes nowhere. How do i fix it? I've tried playing with arp proxy
and manual arp entries to no avail. Do I need to add an extra route?

system details:
debian woody w/ 2.4.18 kernel
iproute       20010824-8
iptables     1.2.6a-5

route table:
210.xxx.xxx.140/30 dev eth0  proto kernel  scope link  src 210.xxx.xxx.142
<-- eth0
210.xxx.xxx.224/29 dev eth2  proto kernel  scope link  src 210.xxx.xxx.225
<-- eth2
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.1   <--
eth1
default via 210.xxx.xxx.141 dev eth0

Any more info needed?

Regards,

Craig Reeson  RHCE
Senior Engineer
Bluechip Infotech (formerly Servex Australia)
Ph. (02) 8745 8465
Mob. 0413 018602


******************************************************************************************************************************************************************

The information transmitted is only for the person or entity to which it is
addressed and may contain confidential and/or privileged material.
Any review, retransmission, dissemination or other use of, or taking of any
action in reliance of this information by any persons or entities other
than the intended recipient is prohibited. If you received this in error
please contact the sender and delete the material from any computer.
******************************************************************************************************************************************************************


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Re: routing problem with new subnet..

[Martin A. Brown]

 : I have a debian (woody) box acting as router for my network and I am trying
 : to setup a dmz (210.xxx.xxx.225/29).

 <routing table snipped>

This is a classic case of a breaking a network in two with proxy ARP.  You 
can do this exactly as you indicate (assuming the xxx.xxx numbers are all 
accurate).

 : anyway, whenever a request comes in for one of the boxes in the dmz the
 : gateway box doesn't seem to answer any arp requests for it. So the
 : connection goes nowhere. How do i fix it? I've tried playing with arp proxy
 : and manual arp entries to no avail. Do I need to add an extra route?

The routes look fine, according to the snipped routing table.

There are (at least) two ways to do it.  I haven't documented the second 
way yet...keep looking around but you can read up on one way to do it here 
(with script and config file):

  http://plorf.net/linux-ip/html/adv-proxy-arp.htm

One thing people frequently forget when using proxy ARP techniques is:

  the upstream router (here at 210.xxx.xxx.141) needs to have
  a /30 prefix length and a static route

               OR

  the upstream router needs to have a a /29 prefix length, and the
  proxy ARPing device needs to proxy ARP for the "internal" network

I'd recommend using tcpdump on both eth0 and eth2 to determine where the 
problem is.

-Martin


-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] Re: routing problem with new subnet..

[Craig Reeson]

Martin (and lartc list),

ok, I have tried the following and it seems to work.
arp -s 210.xxx.xxx.227 -i eth0 -D eth2 pub

so I can now ping from external/internet, or browse (www) to that ip.
would this be the correct method and how should I make it permanent (just a
startup script?).

Regards,

Craig Reeson  RHCE
Senior Engineer
Bluechip Infotech (formerly Servex Australia)
Ph. (02) 8745 8465
Mob. 0413 018602


                                                                                                              
                      "Martin A. Brown"                                                                       
                      <mabrown-lartc@secu        To:       Craig Reeson <craigr@bluechipit.com.au>            
                      repipe.com>                cc:       lartc@mailman.ds9a.nl                              
                                                 Subject:  Re: [LARTC] Re: routing problem with new subnet..  
                      04/12/2002 03:36 PM                                                                     
                                                                                                              
                                                                                                              





 : I have a debian (woody) box acting as router for my network and I am
trying
 : to setup a dmz (210.xxx.xxx.225/29).

 <routing table snipped>

This is a classic case of a breaking a network in two with proxy ARP.  You
can do this exactly as you indicate (assuming the xxx.xxx numbers are all
accurate).

 : anyway, whenever a request comes in for one of the boxes in the dmz the
 : gateway box doesn't seem to answer any arp requests for it. So the
 : connection goes nowhere. How do i fix it? I've tried playing with arp
proxy
 : and manual arp entries to no avail. Do I need to add an extra route?

The routes look fine, according to the snipped routing table.

There are (at least) two ways to do it.  I haven't documented the second
way yet...keep looking around but you can read up on one way to do it here
(with script and config file):

  http://plorf.net/linux-ip/html/adv-proxy-arp.htm

One thing people frequently forget when using proxy ARP techniques is:

  the upstream router (here at 210.xxx.xxx.141) needs to have
  a /30 prefix length and a static route

               OR

  the upstream router needs to have a a /29 prefix length, and the
  proxy ARPing device needs to proxy ARP for the "internal" network

I'd recommend using tcpdump on both eth0 and eth2 to determine where the
problem is.

-Martin


--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com







******************************************************************************************************************************************************************

The information transmitted is only for the person or entity to which it is
addressed and may contain confidential and/or privileged material.
Any review, retransmission, dissemination or other use of, or taking of any
action in reliance of this information by any persons or entities other
than the intended recipient is prohibited. If you received this in error
please contact the sender and delete the material from any computer.
******************************************************************************************************************************************************************


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/