dhcrelay

dhcrelay

[zynkx]

                                _______________
				| gateway 1   |
				|192.168.0.253|
				|81.84.40.XX  |
				_______________
			_______________|
			|              |
		_______________        |
		|DHCP SERVER  |	       |	
	
		|192.168.0.1  |        |
		|_____________|	       |
				       |
				________________
				|GATEWAY2      |
				|192.168.0.253 |
				|192.168.100.254
				|______________|
					|
					|
		
	_________________________________
			|		|	
	|			
		_______________    _______________
______________
		|192.168.100.1 |   |192.168.100.2|
|192.168.100.3|  _______________    ______________
_______________


hi all:


i have this lan i am supposed to use dhcrelay on
gateway 2 so the 192.168.100.0/24 machines can get an
ip address. 192.168.0.1 is the dhcp serveer.i have the 
input and output chain of the
gateway 2 to drop.

my question is:

do those request require input and output to accept? i
don't really think so because those packer are not for
gateway 2 but are to be routed to 192.168.100.0/24
machines...

what do you guys think of this??

sorry for the very bad drawing... 

tanx ;))))
unix is user friendly. it's just selective when
choosing
friends.

-------------------------------------------------
Email Enviado utilizando o serviço MegaMail

----- Final da mensagem re-enviada -----



unix is user friendly. it's just selective when 
choosing 
friends.

-------------------------------------------------
Email Enviado utilizando o serviço MegaMail

Re: dhcrelay

[Jeffrey Laramie]

On Friday 28 November 2003 15:30, zynkx wrote:
>                                 _______________
>
> 				| gateway 1   |
> 				|192.168.0.253|
> 				|81.84.40.XX  |
>
> 				_______________
> 			_______________|
>
> 		_______________        |
>
> 		|DHCP SERVER  |	       |
> 		|
> 		|192.168.0.1  |        |
> 		|_____________|	       |
>
> 				________________
>
> 				|GATEWAY2      |
> 				|192.168.0.253 |
> 				|192.168.100.254
> 				|______________|
>
> 	_________________________________
>
>
> 		_______________    _______________
> ______________
>
> 		|192.168.100.1 |   |192.168.100.2|
> |
> |192.168.100.3|  _______________    ______________
>
> _______________
>
>
> hi all:
>
>
> i have this lan i am supposed to use dhcrelay on
> gateway 2 so the 192.168.100.0/24 machines can get an
> ip address. 192.168.0.1 is the dhcp serveer.i have the
> input and output chain of the
> gateway 2 to drop.
>
> my question is:
>
> do those request require input and output to accept?

No, but you do need to set the default FORWARD policy to ACCEPT and make sure 
forwarding is enabled in gateway 2.

 i
> don't really think so because those packer are not for
> gateway 2 but are to be routed to 192.168.100.0/24
> machines...
>
> what do you guys think of this??
>
> sorry for the very bad drawing...
>

You draw better than I do!

Jeff

dhcrelay

[zynkx]

hi jeff and tanx for answering :)

i'm sure i have ip forward enabled, since gateway 2 is 
working fine and routing packets ok through the lan 
and to gateway 1. if it happened not to have ip 
forward enabled in gateway 2 i could never do 
masquerading from gateway 2 to gateway 1 :)

isn't that so? :)

i think this might be a matter of finding out some 
bind tricks to get this over with... i just wanted to 
be sure input and output to drop would not have 
anything to do with dhcrelay :))

i'm gonna test it with no firewalling at all to see 
what happens ;))

[][]




unix is user friendly. it's just selective when 
choosing 
friends.

-------------------------------------------------
Email Enviado utilizando o serviço MegaMail

Re: dhcrelay

[Jeffrey Laramie]

On Friday 28 November 2003 19:56, zynkx wrote:
> hi jeff and tanx for answering :)
>
> i'm sure i have ip forward enabled, since gateway 2 is
> working fine and routing packets ok through the lan
> and to gateway 1. if it happened not to have ip
> forward enabled in gateway 2 i could never do
> masquerading from gateway 2 to gateway 1 :)
>
> isn't that so? :)
>

Yes. If you're not sure then: "echo 1 >/proc/sys/net/ipv4/ip_forward" will 
turn it on.

> i think this might be a matter of finding out some
> bind tricks to get this over with... i just wanted to
> be sure input and output to drop would not have
> anything to do with dhcrelay :))
>
> i'm gonna test it with no firewalling at all to see
> what happens ;))
>

I'm afraid I don't have any experience with a configuration like your's but I 
don't think iptables will have any effect on dhcp requests. Good luck.

Jeff

Re: dhcrelay

[Ramin Dousti]

On Fri, Nov 28, 2003 at 08:30:16PM +0000, zynkx wrote:

> i have this lan i am supposed to use dhcrelay on
> gateway 2 so the 192.168.100.0/24 machines can get an
> ip address. 192.168.0.1 is the dhcp serveer.i have the 
> input and output chain of the
> gateway 2 to drop.
> 
> my question is:
> 
> do those request require input and output to accept? i
> don't really think so because those packer are not for
> gateway 2 but are to be routed to 192.168.100.0/24
> machines...
> 
> what do you guys think of this??

Do you run the dhcrelay on gateway-2? Then the input should be open for that.
Then the relay is supposed to send out the relayed traffic out, then the output
should be open. However, dhcp broadcasts are being captured by netlink
raw packets (I suppose) so this might be a bit tricky. Give it a go and let
us know.

Ramin

> 
> sorry for the very bad drawing... 
> 
> tanx ;))))
> unix is user friendly. it's just selective when
> choosing
> friends.
> 
> -------------------------------------------------
> Email Enviado utilizando o servi?o MegaMail
> 
> ----- Final da mensagem re-enviada -----
> 
> 
> 
> unix is user friendly. it's just selective when 
> choosing 
> friends.
> 
> -------------------------------------------------
> Email Enviado utilizando o servi?o MegaMail
> 
> 

Re: dhcrelay

[Ralf Spenneberg]

Am Sam, 2003-11-29 um 01.56 schrieb zynkx:
> i'm sure i have ip forward enabled, since gateway 2 is 
> working fine and routing packets ok through the lan 
> and to gateway 1. if it happened not to have ip 
> forward enabled in gateway 2 i could never do 
> masquerading from gateway 2 to gateway 1 :)
> 
dhcrelay is a local application. It works as a proxy. You have to allow
incoming packets on broadcast and unicast address in your INPUT chain.
Again the OUTPUT chain must be open, too. DHCP is not forwarded.
> i'm gonna test it with no firewalling at all to see 
> what happens ;))
It won't work.


Cheers,

Ralf

-- 
Ralf Spenneberg
RHCE, RHCX

Book: VPN mit Linux
Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org

dhcrelay

[Dr. Lars Hanke]

Hi,

google told me that dhcrelay has been discussed quite a couple of times on 
this list. However,I could not find a solution to my problem.

I want to set up a router, which distributes the DHCP configuration service to 
all subnets attached (well currently only one subnet at eth0, 172.16.2.1). 
Reading the dhcrelay man page
#> dhcrelay -i eth0 adept.mgr

should do exactly that. In practice - almost:

dhcrelay gets the request, asks the dhcp server, gets a reply, but never sends 
it to the requesting device:

#> tcpdump -i any port bootpc or port bootps
09:42:09.996479 172.16.1.12.bootpc > 255.255.255.255.bootps: xid:0x960f0000 
flags:0x8000 [|bootp] 
09:42:09.997009 surtur.mgr.bootps > adept.mgr.bootps: (request) xid:0x960f0000 
flags:0x8000 G:172.16.2.1 ether 0:9:5b:68:19:fb [|bootp] (DF) 
09:42:09.997603 adept.mgr.bootps > 172.16.2.1.bootps: (reply) xid:0x960f0000 
flags:0x8000 Y:ymir.mgr S:adept.mgr G:172.16.2.1 ether 0:9:5b:68:19:fb [|
bootp] (DF) 

... but something like the following never appears (line taken from DHCP 
exchange from server installed on router, alternatively):

09:59:38.780364 172.16.2.1.bootps > 255.255.255.255.bootpc: xid:0x960f0000 
flags:0x8000 Y:ymir.mgr S:172.16.2.1 [|bootp] [tos 0x10] 

Therefore, ymir never gets his IP! 

netfilter policies were set to ACCEPT and all tables were flushed (including 
nat and mangle). I can ping all NIC from anywhere, ymir of course only if it 
is configured!

The system is Debian Woody with 2.4.26-grsec Kernel from backports. grsec 
stuff is not activated by gradm.

Any help appreciated,
 - lars.