Problem Found! - Firewall Rule

Problem Found! - Firewall Rule

[John Paul]

[-- Attachment #1: Type: text/plain, Size: 2049 bytes --]

Hello Folks, its me again :(

Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.

Thanks!
/JP



PC1 (192.168.0.20) ----> gateway(LinuxServer) <-------------------> internet <--------------------> VPN Server
                                   eth0 : 1.1.1.1                                                                        eth0 : 2.2.2.2
                                   eth1 : 192.168.0.1                                                                 local ip: 192.168.0.10
                                                                                                                              remote ip: 192.168.0.180-200  

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

PC1 is already connected to the VPN server. PC1 ip now becomes;

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : 
        IP Address. . . . . . . . . . . . : 192.168.0.253
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.10

PPP adapter Sytes.Net:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.0.180
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 192.168.0.180

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
202.163.246.1   0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.0.180   0.0.0.0         255.255.255.255 UH    0      0        0 ppp1
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         202.163.246.1   0.0.0.0         UG    0      0        0 ppp0

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

[-- Attachment #2: Type: text/html, Size: 6026 bytes --]

RE: Problem Found! - Firewall Rule

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 1446 bytes --]

Your local IP is the same as the remote networks IP.. so how is the local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?
 
The only way I know is to proxyarp the ppp device that the vpn is running on.. I'm assuming it's PPTP so you could try this command when the VPN comes up :
echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp
 
and this must be done on the VPN server too..
I've never done it this way with a VPN.. but you can only try it..
 
I'm surprised that anything really works properly the way you've done it because the firewall has 2 network devices with the same IP range.

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: John Paul [mailto:john@pinoylinux.sytes.net]
Sent: Friday, June 06, 2003 9:56 AM
To: netfilter@lists.netfilter.org
Subject: Problem Found! - Firewall Rule


Hello Folks, its me again :(
 
Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.
 
Thanks!
/JP
 

[-- Attachment #2: Type: text/html, Size: 5483 bytes --]

RE: Problem Found! - Firewall Rule

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1997 bytes --]

On Fri, 2003-06-06 at 02:56, George Vieira wrote:
> Your local IP is the same as the remote networks IP.. so how is the
> local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?
>  
> The only way I know is to proxyarp the ppp device that the vpn is
> running on.. I'm assuming it's PPTP so you could try this command when
> the VPN comes up :
> echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp
You can also use the netfilter P-O-M route patch, which allows you to
redirect traffic via different interfaces (route) based on regular
iptables conditions (-s, -d, -p, etc).

>  
> and this must be done on the VPN server too..
> I've never done it this way with a VPN.. but you can only try it..
>  
> I'm surprised that anything really works properly the way you've done
> it because the firewall has 2 network devices with the same IP range.
> 
> Thanks,
> 
> 
>  
> ____________________________________________
> George Vieira
> Citadel Computer Systems Pty Ltd Systems Managergeorgev AT
> citadelcomputer DOT com DOT au
> Citadel Computer Systems Pty Ltd
> Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698
> http://www.citadelcomputer.com.au
>  
>  
> -----Original Message-----
> From: John Paul [mailto:john@pinoylinux.sytes.net]
> Sent: Friday, June 06, 2003 9:56 AM
> To: netfilter@lists.netfilter.org
> Subject: Problem Found! - Firewall Rule
> 
> 
> Hello Folks, its me again :(
>  
> Below is my config. My problem is, I can connect to VPN but for some
> reason, I cannot see machines inside the network after being
> connected. Can somebody give me the simpliest firewall rule on this?
> just for me to see the machines inside the network.
>  
> Thanks!
> /JP
>  
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Problem Found! - Firewall Rule

[John Paul]

[-- Attachment #1: Type: text/plain, Size: 1904 bytes --]

Thanks George. I have modified my network to (10.10.0.0/24). 

Now, I'am able to ping the machines inside the network after connected to the VPN. The problem now is, I'm not able to map/see machines in Network Neighborhood except the VPN server.

Any clue?       


  ----- Original Message ----- 
  From: George Vieira 
  To: John Paul ; netfilter@lists.netfilter.org 
  Sent: Friday, June 06, 2003 8:56 AM
  Subject: RE: Problem Found! - Firewall Rule


  Your local IP is the same as the remote networks IP.. so how is the local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?

  The only way I know is to proxyarp the ppp device that the vpn is running on.. I'm assuming it's PPTP so you could try this command when the VPN comes up :
  echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp

  and this must be done on the VPN server too..
  I've never done it this way with a VPN.. but you can only try it..

  I'm surprised that anything really works properly the way you've done it because the firewall has 2 network devices with the same IP range.
  Thanks,


  ____________________________________________
  George Vieira
  Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT au
  Citadel Computer Systems Pty Ltd
  Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au


  -----Original Message-----
  From: John Paul [mailto:john@pinoylinux.sytes.net]
  Sent: Friday, June 06, 2003 9:56 AM
  To: netfilter@lists.netfilter.org
  Subject: Problem Found! - Firewall Rule


  Hello Folks, its me again :(

  Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.

  Thanks!
  /JP


[-- Attachment #2: Type: text/html, Size: 7210 bytes --]

RE: Problem Found! - Firewall Rule

[George Vieira]

The only solution to this is to make the VPN server or the other network be the master browser of that network.. so it handles all the netbios broadcasts and all.
 
Once this is done, setup samba on the remote firewall to do a "remote announce = 10.10.255.255" onto your network... something like that.. it's been a while since I've done this..
 
Though this must be the VPN server that runs the master browser because broadcasts DO NOT ROUTE so it can't be done with a server inside the VPN servers network..
 
give that a try. static mappings should work though as long as you know what your looking for.
 

	-----Original Message----- 
	From: John Paul [mailto:john@pinoylinux.sytes.net] 
	Sent: Mon 09-Jun-03 1:35 PM 
	To: George Vieira; netfilter@lists.netfilter.org 
	Cc: 
	Subject: Re: Problem Found! - Firewall Rule