Iptables and Zebra

Iptables and Zebra

[Bertrand TACHAGO]

[-- Attachment #1: Type: text/plain, Size: 489 bytes --]

Hi to all!
I'm trying to setup a zebra router on a RH9 machine but right I'm blocked because there's a firewall (iptables) problem. I had entered a POSTROUTING rule (iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE) but the packets are not routed to the external interface. Can somebody help me solve this problem (use zebra routing protocol to route packets from my network to the Internet)?

Bertrand TACHAGO
Computer specialist / Network administrator
Cellular: (237) 975 55 31

[-- Attachment #2: Type: text/html, Size: 950 bytes --]

Re: Iptables and Zebra

[Antony Stone]

On Tuesday 16 December 2003 9:34 am, Bertrand TACHAGO wrote:

> Hi to all!
> I'm trying to setup a zebra router on a RH9 machine but right I'm blocked
> because there's a firewall (iptables) problem. I had entered a POSTROUTING
> rule (iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE) but the packets
> are not routed to the external interface. Can somebody help me solve this
> problem (use zebra routing protocol to route packets from my network to the
> Internet)?

Netfilter does not route packets for you.   It can change the source or 
destination addresses, and it can block certain packets from being routed, 
but the decision about where / how / why to route packets is not made by 
netfilter.

The rule you have given above will make sure that all packets leaving 
interface eth0 will have the IP address of that interface as their source 
address.   It does not affect in any way which packets get routed via eth0 on 
their way anywhere else.

Sorry I can't be more help, but I wanted to make sure you understood that a 
routing problem is not a netfilter problem.

Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Iptables and Zebra

[Ralf Spenneberg]

Am Die, 2003-12-16 um 10.34 schrieb Bertrand TACHAGO:
> Hi to all!
> I'm trying to setup a zebra router on a RH9 machine but right I'm
> blocked because there's a firewall (iptables) problem. I had entered a
> POSTROUTING rule (iptables -t nat -A POSTROUTING -o eth0 -j
> MASQUERADE) but the packets are not routed to the external interface.
> Can somebody help me solve this problem (use zebra routing protocol to
> route packets from my network to the Internet)?
Why are you trying to setup zebra? 

If you just want the Linux box to operate as a simple router between two
networks, remove zebra, activate forwarding and masquerading and you are
done.
Forwarding:
sysctl -w net.ipv4.ip_forward=1

The needed static routes are usually set automatically as soon as the
interfaces are initialized.
>  
Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: VPN mit Linux
Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org

Re: Iptables and Zebra

[Bertrand TACHAGO]

Bertrand TACHAGO
Computer specialist / Network administrator
Cellular: (237) 975 55 31
----- Original Message ----- 
From: "Ralf Spenneberg" <lists@spenneberg.org>
To: "Bertrand TACHAGO" <btachago@creolink.net>
Cc: "Netfilter" <netfilter@lists.netfilter.org>
Sent: Tuesday, December 16, 2003 12:06 PM
Subject: Re: Iptables and Zebra


Am Die, 2003-12-16 um 10.34 schrieb Bertrand TACHAGO:
> Hi to all!
> I'm trying to setup a zebra router on a RH9 machine but right I'm
> blocked because there's a firewall (iptables) problem. I had entered a
> POSTROUTING rule (iptables -t nat -A POSTROUTING -o eth0 -j
> MASQUERADE) but the packets are not routed to the external interface.
> Can somebody help me solve this problem (use zebra routing protocol to
> route packets from my network to the Internet)?
Why are you trying to setup zebra?

If you just want the Linux box to operate as a simple router between two
networks, remove zebra, activate forwarding and masquerading and you are
done.
Forwarding:
sysctl -w net.ipv4.ip_forward=1

The needed static routes are usually set automatically as soon as the
interfaces are initialized.
>
Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: VPN mit Linux
Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto      http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org

I'm trying to setup zebra because I have 3 subnets with 3 linux boxes
configured as router with zebra and ospfd. Maybe if I activate Masquerading,
it would work.
Cheers,