From: Antony Stone <Antony@Soft-Solutions.co.uk>
To: netfilter@lists.netfilter.org
Subject: Re: DHCRELAY through IPTABLES Firewall
Date: Tue, 29 Oct 2002 13:03:17 +0000 [thread overview]
Message-ID: <200210291303.g9TD3Ne10065@vulcan.rissington.net> (raw)
In-Reply-To: <004201c27f3d$20c88520$8f33e40f@lsmith5953>
On Tuesday 29 October 2002 11:20 am, bigman@monster-solutions.net wrote:
> below is what gets logged when using DHCRELAY. It looks like it will work
> but then I never see the request from the 192.168.2.69 (firewall) hit the
> DHCP server which I am running a sniffer on. I must be making this harder
> then it should be. Can you provide me with the steps to get DHCRELAY
> working across different subnets. I really appreciate all of the help.
>
> Oct 29 07:13:12 firewall kernel: IN=eth2 OUT=
> MAC=ff:ff:ff:ff:ff:ff:08:00:09:f1:b2:ba:08:00 SRC=0.0.0.0
> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=128 ID=8523 PROTO=UDP
> SPT=68 DPT=67 LEN=308
Packet comes in on eth2 with broadcast destination IP and MAC adresses,
source IP address = 0.0.0.0
> Oct 29 07:13:12 firewall kernel: IN= OUT=eth2 SRC=192.168.2.69
> DST=192.168.1.70 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=67
> DPT=67 LEN=308
The the firewall sends a packet from its own IP address 192.168.2.69 to the
DHCP server 192.168.1.70 on *eth2* !!!
Why ?
> Oct 29 07:13:27 firewall kernel: IN=eth2 OUT=
> MAC=ff:ff:ff:ff:ff:ff:08:00:09:f1:b2:ba:08:00 SRC=0.0.0.0
> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=128 ID=8537 PROTO=UDP
> SPT=68 DPT=67 LEN=308
DHCP client hasn't had an answer within 15 seconds so it asks again.
> Oct 29 07:13:27 firewall kernel: IN= OUT=eth2 SRC=192.168.2.69
> DST=192.168.1.70 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=67
> DPT=67 LEN=308
Firewall sends the request to 192.168.1.70 out of the wrong interface again.
Antony.
--
Normal people think "if it ain't broke, don't fix it".
Engineers think "if it ain't broke, it doesn't have enough features yet".
next prev parent reply other threads:[~2002-10-29 13:03 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-27 4:33 DHCRELAY through IPTABLES Firewall bigman
2002-10-27 8:09 ` Antony Stone
2002-10-27 8:58 ` bigman
2002-10-28 8:49 ` Antony Stone
2002-10-28 10:36 ` bigman
2002-10-28 10:54 ` Antony Stone
2002-10-28 11:26 ` bigman
2002-10-28 11:39 ` Antony Stone
2002-10-29 7:37 ` bigman
2002-10-29 9:15 ` Antony Stone
2002-10-29 11:20 ` bigman
2002-10-29 13:03 ` Antony Stone [this message]
2002-10-30 0:30 ` bigman
2002-10-30 0:41 ` Antony Stone
2002-10-30 7:15 ` bigman
2002-10-29 10:02 ` bigman
2002-10-29 10:29 ` Antony Stone
2002-10-29 11:44 ` bigman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200210291303.g9TD3Ne10065@vulcan.rissington.net \
--to=antony@soft-solutions.co.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox