network setup help

network setup help

[Jee J.Z.]

Dear all,

I am trying to setup three PCs and do some simple filter+nat jobs. I'm a
green hand on netfilter and linux and seem to always get something wrong. I
apologize that my current problem has not reached the range of netfilter;
instead, it's about network configuration. But I believe people on this list
are very experienced on it. The situation is specified below:

1.PC1 has one NIC with a global IP connected to a Switch;
2.PC2 has two NICs, eth0 with a global IP connected to the Switch and eth1
with an internal IP (192.168.0.1/24) directly connected to PC3's eth1;
3.PC3 has two NICs, eth0 with a global IP connected to the Switch and eth1
with an internal IP (192.168.0.2/24) directly connected to PC2's eth1.

              Internet
                 |        +--------+----+
              +------+<-->+PC2/eth0|eth1+
+--------+    +      +    +--------+--+-+
+PC1/eth0+<-->+Switch+                |
+--------+    +      +    +--------+--+-+
              +------+<-->+PC3/eth0|eth1+
                          +--------+----+

I am trying to send packets from PC1 to PC3, via PC1/eth0(global
IP)-->PC2/eth0(global IP)-->PC2/eth1(192.168.0.1)-->PC3/eth1(192.168.0.2).
Actually, PC3/eth0 is not in used in the case.

Problems:
Currently I fail to ping from PC3 to PC2/eth1(192.168.0.1). Actually I don't
know which NIC PC3 is using to send the ping packets. I try disconnecting
PC3/eth0, but it still does not work. Could anyone throw some light on it
and warn me what I should pay attention to? Many many thanks!

Regards,
Jee

Re: network setup help

[Antony Stone]

On Saturday 10 April 2004 7:54 pm, Jee J.Z. wrote:

> Dear all,
>
> I am trying to setup three PCs and do some simple filter+nat jobs. The
> situation is specified below:
>
> 1.PC1 has one NIC with a global IP connected to a Switch;
> 2.PC2 has two NICs, eth0 with a global IP connected to the Switch and eth1
> with an internal IP (192.168.0.1/24) directly connected to PC3's eth1;
> 3.PC3 has two NICs, eth0 with a global IP connected to the Switch and eth1
> with an internal IP (192.168.0.2/24) directly connected to PC2's eth1.

!? Why !?

(Either, why are PC2 and PC3 connected, or, why are both PC2 and PC3 connected 
to the switch?)

> I am trying to send packets from PC1 to PC3, via PC1/eth0(global
> IP)-->PC2/eth0(global IP)-->PC2/eth1(192.168.0.1)-->PC3/eth1(192.168.0.2).
> Actually, PC3/eth0 is not in used in the case.

So, what's PC3/eth0 for?

I think your problem is a routing table (almost certainly the one on PC3, but 
possibly the one on PC2).

Look at the routing table of each machine the packets are going through, and 
then the replies trying to get back again, and see if (a) there is a path, 
and (b) it makes sense.

I think once you've done this you will find the source of your problem, but I 
really do recommend you think about your network setup, and the path you are 
trying to get packets to take, and ask yourself "why do it like this?"

For your benefit I have specifically selected the sig on this email :)

Regards,

Antony.

-- 
90% of networking problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: network setup help

[Jee J.Z.]

Hi Antony,

Thanks for your reply. Please see inline:

> On Saturday 10 April 2004 7:54 pm, Jee J.Z. wrote:
>
> > Dear all,
> >
> > I am trying to setup three PCs and do some simple filter+nat jobs. The
> > situation is specified below:
> >
> > 1.PC1 has one NIC with a global IP connected to a Switch;
> > 2.PC2 has two NICs, eth0 with a global IP connected to the Switch and
eth1
> > with an internal IP (192.168.0.1/24) directly connected to PC3's eth1;
> > 3.PC3 has two NICs, eth0 with a global IP connected to the Switch and
eth1
> > with an internal IP (192.168.0.2/24) directly connected to PC2's eth1.
>
> !? Why !?
>
> (Either, why are PC2 and PC3 connected, or, why are both PC2 and PC3
connected
> to the switch?)
>
> > I am trying to send packets from PC1 to PC3, via PC1/eth0(global
> > IP)-->PC2/eth0(global
IP)-->PC2/eth1(192.168.0.1)-->PC3/eth1(192.168.0.2).
> > Actually, PC3/eth0 is not in used in the case.
>
> So, what's PC3/eth0 for?

You are right. PC3/eth0 is a redundancy in this setup. That's why I tried
disabling PC3/eth0. I am just curious that when more than one NIC are
activated, which one will the PC choose to send packets? I guess one of them
should be a default NIC, right? How do I know or set one as default?


> I think your problem is a routing table (almost certainly the one on PC3,
but
> possibly the one on PC2).

Right. I am quite new to setting up routing tables. That should be the
reason... :(

> Look at the routing table of each machine the packets are going through,
and
> then the replies trying to get back again, and see if (a) there is a path,
> and (b) it makes sense.

Both PC2 and PC3's routing look like:
Destination                Gateway                   Genmask
Flags      Metric      Ref      Iface
192.168.0.0               0.0.0.0                     255.255.255.0
U            0           0        eth1
144.32.xxx.0              0.0.0.0                     255.255.254.0
U            0           0        eth0
127.0.0.0                  0.0.0.0                     255.0.0.0
U            0           0         lo
0.0.0.0                     144.32.xxx.yyy           0.0.0.0
UG           0           0        eth0

I haven't added anything to the routing tables, and not quite sure what
rules I should add. I have ever tried adding a default gateway, but it
doesn't seem to work. I know I must be missing something obvious. Could you
show me your thoughts?

> I think once you've done this you will find the source of your problem,
but I
> really do recommend you think about your network setup, and the path you
are
> trying to get packets to take, and ask yourself "why do it like this?"

Once getting rid of PC3/eth0, four NICs remained are involved:
PC1/eth0-->PC2/eth0-->(filter,nat)-->PC2/eth1-->PC3/eth1. Then any problems?

> For your benefit I have specifically selected the sig on this email :)

Thank you!:)

> Regards,
>
> Antony.
>
> -- 
> 90% of networking problems are routing problems.
> 9 of the remaining 10% are routing problems in the other direction.
> The remaining 1% might be something else, but check the routing anyway.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>

Re: network setup help

[Antony Stone]

On Sunday 11 April 2004 12:33 am, Jee J.Z. wrote:

> Hi Antony,

Thanks for getting the spelling right - lots of people round here don't :)

> > Look at the routing table of each machine the packets are going through,
> > and then the replies trying to get back again, and see if (a) there is a
> > path, and (b) it makes sense.
>
> Both PC2 and PC3's routing look like:
> Destination                Gateway                   Genmask
> Flags      Metric      Ref      Iface
> 192.168.0.0               0.0.0.0                     255.255.255.0
> U            0           0        eth1
> 144.32.xxx.0              0.0.0.0                     255.255.254.0
> U            0           0        eth0
> 127.0.0.0                  0.0.0.0                     255.0.0.0
> U            0           0         lo
> 0.0.0.0                     144.32.xxx.yyy           0.0.0.0
> UG           0           0        eth0

Okay, I'm assuming that 144.32.xxx.yyy is not the address of PC1 - it's 
something else which is connected to your switch - however that's not too 
important here.

Here's what I think is going on:

PC1 has a simple routing table saying "network 144.32.xxx.0/23 is on eth0, and 
the deafult gateway is 144.32.xxx.yyy".   That means if you ping 192.168.0.2 
from PC1 it will send the packets to the default gateway :(

Set a network route on PC1 to tell it how to find the 192.168.0.0/24 network, 
via PC2 as a router:

route add -net 192.168.0.0 netmask 255.255.255.0 gw 144.32.xxx.b

where 144.32.xxx.b is the IP address on PC2/eth0

Once you have done that I think the pings will work, however they will not 
work the way you would like them to :)

An echo request packet will come from 144.32.xxx.a (PC1/eth0) to 192.168.0.2 
and get routed (by your new routing table entry on PC1) via 144.32.xxx.b, 
where PC2 will decide "192.168.0.2? Oh, that's on my eth1", and will send it 
to PC2.

However, if PC2/eth0 is still operational and plugged in, it will think "I 
have to send an echo response packet to 144.32.xxx.a, and that's on this 
subnet connected to my eth0", so it will send the reply packet out through 
eth0.

This will actually work for pings, but it's not the way you want TCP packets 
to flow (remember that pings are ICMP packets), and it certainly won't work 
once you start doing nat on PC2 (which I assume, for some reason, that you do 
want to do?).

However, I still remain puzzled about why you have this crazy setup in the 
first place, and what you're trying to achieve by sending pings from PC1 to 
PC3 via PC2, so add the routing table entry to PC1, check whether a ping 
works (with all the cables plugged in, so all the paths shown on your 
original diagram are available), and then try to explain to us why you are 
doing things this way and what you want to achieve.

Regards,

Antony.

-- 
If at first you don't succeed, destroy all the evidence that you tried.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: network setup help

[Jee J.Z.]

> On Sunday 11 April 2004 12:33 am, Jee J.Z. wrote:
> 
> > Hi Antony,
> 
> Thanks for getting the spelling right - lots of people round here don't :)

Because I try not to annoy you in the very beginning. :)
 
> > > Look at the routing table of each machine the packets are going through,
> > > and then the replies trying to get back again, and see if (a) there is a
> > > path, and (b) it makes sense.
> >
> > Both PC2 and PC3's routing look like:
> > Destination                Gateway                   Genmask
> > Flags      Metric      Ref      Iface
> > 192.168.0.0               0.0.0.0                     255.255.255.0
> > U            0           0        eth1
> > 144.32.xxx.0              0.0.0.0                     255.255.254.0
> > U            0           0        eth0
> > 127.0.0.0                  0.0.0.0                     255.0.0.0
> > U            0           0         lo
> > 0.0.0.0                     144.32.xxx.yyy           0.0.0.0
> > UG           0           0        eth0
> 
> Okay, I'm assuming that 144.32.xxx.yyy is not the address of PC1 - it's 
> something else which is connected to your switch - however that's not too 
> important here.

Right. 144.32.xxx.yyy should be a router on the 144.32.xxx.0/24 network.
 
> Here's what I think is going on:
> 
> PC1 has a simple routing table saying "network 144.32.xxx.0/23 is on eth0, and 
> the deafult gateway is 144.32.xxx.yyy".   That means if you ping 192.168.0.2 
> from PC1 it will send the packets to the default gateway :(

Oh, sorry to get you confused. I am not trying to ping from PC1 to PC3. I am trying to ping from PC2 to PC3 or from PC3 to PC2 to test their connectivity (between PC2 and PC3). Besides the routing table, I am also considering whether my configurations for setting up two NICs on one box are problematic or not at this moment.
 
> Set a network route on PC1 to tell it how to find the 192.168.0.0/24 network, 
> via PC2 as a router:
> 
> route add -net 192.168.0.0 netmask 255.255.255.0 gw 144.32.xxx.b
> 
> where 144.32.xxx.b is the IP address on PC2/eth0
> 
> Once you have done that I think the pings will work, however they will not 
> work the way you would like them to :)
> 
> An echo request packet will come from 144.32.xxx.a (PC1/eth0) to 192.168.0.2 
> and get routed (by your new routing table entry on PC1) via 144.32.xxx.b, 
> where PC2 will decide "192.168.0.2? Oh, that's on my eth1", and will send it 
> to PC2.
> 
> However, if PC2/eth0 is still operational and plugged in, it will think "I 
> have to send an echo response packet to 144.32.xxx.a, and that's on this 
> subnet connected to my eth0", so it will send the reply packet out through 
> eth0.
> 
> This will actually work for pings, but it's not the way you want TCP packets 
> to flow (remember that pings are ICMP packets), and it certainly won't work 
> once you start doing nat on PC2 (which I assume, for some reason, that you do 
> want to do?).

Your descriptions above make sense. And right, I will do filtering and nat on PC2 after I sort the current problem out. Once I set up filter and nat on PC2, PC1 does not need "route add -net 192.168.0.0 netmask 255.255.255.0 gw 144.32.xxx.b
" any more, and PC1 should not know there is a 192.168.0.0 network behind PC2, right?
 
> However, I still remain puzzled about why you have this crazy setup in the 
> first place, and what you're trying to achieve by sending pings from PC1 to 
> PC3 via PC2, so add the routing table entry to PC1, check whether a ping 
> works (with all the cables plugged in, so all the paths shown on your 
> original diagram are available), and then try to explain to us why you are 
> doing things this way and what you want to achieve.

OK, I am trying to set up a simple firewall (just do filtering and nat) between PC3 and the outside world. PC2 is where the firewall locates. And PC1 is just a traffic sender for testing after the firewall is built up. At this moment, the first thing I need to figure out is why the connectivity between PC2/eth1 and PC3/eth1 seems not working. I think the reasons lie in either routing table setup (on PC2 and PC3) or dual NIC configurations. Any suggestions?

Many thanks,
Jee

> Regards,
> 
> Antony.
> 
> -- 
> If at first you don't succeed, destroy all the evidence that you tried.
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
> 
> 
> 

Re: network setup help

[Antony Stone]

On Sunday 11 April 2004 3:00 am, Jee J.Z. wrote:

> > Here's what I think is going on:
> >
> > PC1 has a simple routing table saying "network 144.32.xxx.0/23 is on
> > eth0, and the deafult gateway is 144.32.xxx.yyy".   That means if you
> > ping 192.168.0.2 from PC1 it will send the packets to the default gateway
> > :(
>
> Oh, sorry to get you confused. I am not trying to ping from PC1 to PC3.

Ah, I read your first posting which said "I am trying to send packets from PC1 
to PC3, via PC1/eth0 (global IP) --> PC2/eth0 (global IP) --> PC2/eth1 
(192.168.0.1) --> PC3/eth1 (192.168.0.2)" and assumed that this was what you 
were testing right now and having problems with.

I now see that later on in that first posting you did say "Currently I fail to 
ping from PC3 to PC2/eth1 (192.168.0.1)", so I guess I should have started 
with the simple stuff first :)

> I am trying to ping from PC2 to PC3 or from PC3 to PC2 to test their
> connectivity (between PC2 and PC3). Besides the routing table, I am also
> considering whether my configurations for setting up two NICs on one box
> are problematic or not at this moment.

Er, well, there's not much you can get wrong with that?   Let's go over a few 
basics:

1. Each NIC on one box has an IP address in a different subnet (correct, 
according to your first posting).
2. The routing table on each box tells it how to get to each subnet, as well 
as a default route (correct, according to your second posting).
3. The two NICs are connected with a crossover CAT5 cable, or straight-through 
cables and a hub/switch (?).
4. There are no netfilter rules on either machine dropping packets or 
redirecting them elsewhere (?).

If you can't ping between PC2 and PC3, how about from PC2 to PC1, or from PC1 
to PC3? (using their public addresses this time, since PC1 doesn't know how 
to route to the private addresses)

> Your descriptions above make sense. And right, I will do filtering and nat
> on PC2 after I sort the current problem out. Once I set up filter and nat
> on PC2, PC1 does not need "route add -net 192.168.0.0 netmask 255.255.255.0
> gw 144.32.xxx.b " any more, and PC1 should not know there is a 192.168.0.0
> network behind PC2, right?

That depends on what NAT you set up on PC2 (and the simplest way to understand 
what I mean here is "what address would PC1 ping in order to contact PC3?").

> > However, I still remain puzzled about why you have this crazy setup in
> > the first place, and what you're trying to achieve by sending pings from
> > PC1 to PC3 via PC2, so add the routing table entry to PC1, check whether
> > a ping works (with all the cables plugged in, so all the paths shown on
> > your original diagram are available), and then try to explain to us why
> > you are doing things this way and what you want to achieve.
>
> OK, I am trying to set up a simple firewall (just do filtering and nat)
> between PC3 and the outside world. PC2 is where the firewall locates. And
> PC1 is just a traffic sender for testing after the firewall is built up.

In that case, unplug PC3/eth0 -> switch, remove the IP address from PC3/eth0, 
and set the default gateway for PC3s routing table to 192.168.0.1

If you intend PC3 to communicate with the world through PC2, set it up like 
that in the first place (even though you may not be able to communicate with 
much of the world beyond your Internet router until you get some NAT running 
on PC2) because otherwise the routing table on PC3 is just going to confuse 
matters.

See if you can confirm points 3 and 4 above, and perhaps check out the 
paragraph after point 4, and see where that gets you.

Regards,

Antony.

-- 
"Reports that say that something hasn't happened are always interesting to me, 
because as we know, there are known knowns; there are things we know we know. 
We also know there are known unknowns; that is to say we know there are some 
things we do not know. But there are also unknown unknowns - the ones we 
don't know we don't know."

 - Donald Rumsfeld, US Secretary of Defence

                                                     Please reply to the list;
                                                           please don't CC me.

Re: network setup help

[Jee J.Z.]

> On Sunday 11 April 2004 3:00 am, Jee J.Z. wrote:
>
> > > Here's what I think is going on:
> > >
> > > PC1 has a simple routing table saying "network 144.32.xxx.0/23 is on
> > > eth0, and the deafult gateway is 144.32.xxx.yyy".   That means if you
> > > ping 192.168.0.2 from PC1 it will send the packets to the default
gateway
> > > :(
> >
> > Oh, sorry to get you confused. I am not trying to ping from PC1 to PC3.
>
> Ah, I read your first posting which said "I am trying to send packets from
PC1
> to PC3, via PC1/eth0 (global IP) --> PC2/eth0 (global IP) --> PC2/eth1
> (192.168.0.1) --> PC3/eth1 (192.168.0.2)" and assumed that this was what
you
> were testing right now and having problems with.
>
> I now see that later on in that first posting you did say "Currently I
fail to
> ping from PC3 to PC2/eth1 (192.168.0.1)", so I guess I should have started
> with the simple stuff first :)
>
> > I am trying to ping from PC2 to PC3 or from PC3 to PC2 to test their
> > connectivity (between PC2 and PC3). Besides the routing table, I am also
> > considering whether my configurations for setting up two NICs on one box
> > are problematic or not at this moment.
>
> Er, well, there's not much you can get wrong with that?   Let's go over a
few
> basics:
>
> 1. Each NIC on one box has an IP address in a different subnet (correct,
> according to your first posting).
> 2. The routing table on each box tells it how to get to each subnet, as
well
> as a default route (correct, according to your second posting).
> 3. The two NICs are connected with a crossover CAT5 cable, or
straight-through
> cables and a hub/switch (?).

It's a crossover cable. The NIC LEDs shine, but the flicker frequency is
very very low. This may be because there are not many packets sent over.

> 4. There are no netfilter rules on either machine dropping packets or
> redirecting them elsewhere (?).

No. I've checked it.

> If you can't ping between PC2 and PC3, how about from PC2 to PC1, or from
PC1
> to PC3? (using their public addresses this time, since PC1 doesn't know
how
> to route to the private addresses)

Yes, when using global IPs, everything works fine. The three machines can
all access the Internet using their global IP.

> > Your descriptions above make sense. And right, I will do filtering and
nat
> > on PC2 after I sort the current problem out. Once I set up filter and
nat
> > on PC2, PC1 does not need "route add -net 192.168.0.0 netmask
255.255.255.0
> > gw 144.32.xxx.b " any more, and PC1 should not know there is a
192.168.0.0
> > network behind PC2, right?
>
> That depends on what NAT you set up on PC2 (and the simplest way to
understand
> what I mean here is "what address would PC1 ping in order to contact
PC3?").

I would like to ftp from PC1 to PC3 in the future, however, I think I should
use "ftp PC2_global_IP". If nat is set up on PC2, PC1 is ftp-ing PC3; if nat
is not set up, then PC1 is ftp-ing PC2. Are there any problems with this
assumption?

> > > However, I still remain puzzled about why you have this crazy setup in
> > > the first place, and what you're trying to achieve by sending pings
from
> > > PC1 to PC3 via PC2, so add the routing table entry to PC1, check
whether
> > > a ping works (with all the cables plugged in, so all the paths shown
on
> > > your original diagram are available), and then try to explain to us
why
> > > you are doing things this way and what you want to achieve.
> >
> > OK, I am trying to set up a simple firewall (just do filtering and nat)
> > between PC3 and the outside world. PC2 is where the firewall locates.
And
> > PC1 is just a traffic sender for testing after the firewall is built up.
>
> In that case, unplug PC3/eth0 -> switch, remove the IP address from
PC3/eth0,
> and set the default gateway for PC3s routing table to 192.168.0.1

OK, I've got rid of PC3/eth0 now. But before I set the default gateway for
PC3, it should be no problem to ping 192.168.0.1 from it, right?

> If you intend PC3 to communicate with the world through PC2, set it up
like
> that in the first place (even though you may not be able to communicate
with
> much of the world beyond your Internet router until you get some NAT
running
> on PC2) because otherwise the routing table on PC3 is just going to
confuse
> matters.

Right.

> See if you can confirm points 3 and 4 above, and perhaps check out the
> paragraph after point 4, and see where that gets you.

Oh, I am even more confused what's going wrong now. :(

> Regards,
>
> Antony.
>
> -- 
> "Reports that say that something hasn't happened are always interesting to
me,
> because as we know, there are known knowns; there are things we know we
know.
> We also know there are known unknowns; that is to say we know there are
some
> things we do not know. But there are also unknown unknowns - the ones we
> don't know we don't know."
>
>  - Donald Rumsfeld, US Secretary of Defence
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>