* Unusual routing problem
@ 2003-03-24 18:25 Benjamin Tompkins
2003-03-24 19:28 ` Kim Jensen
0 siblings, 1 reply; 6+ messages in thread
From: Benjamin Tompkins @ 2003-03-24 18:25 UTC (permalink / raw)
To: netfilter
I am attempting to route myself an ip block from my office to my home via a
tunnel. Simple enough. The catch is, I only want the tunnel to be used for
lan destined traffic and incoming connections to my IP block. The lan
destined traffic is easy, the trick apparently is getting the block to be
accessible via the internet, without forcing all traffic to use the tunnel.
A diagram.
eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
\ /
Linux Machine
|
ppp0 (x.x.x.2/30)
Ok, so what I have so far is as follows.
This takes care of access to the office network.
route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
route add -host x.x.x.1 dev eth0
Now to use the cable for everything else.
iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
So now I can access my office lan and vice versa, and everything else gets
masqed out the cable. But I'm having a heck of a time letting the box to
know that stuff requested via ppp0, needs to go out ppp0. I have looked at
using the mangle table making rules for input and forward, but am just
missing something along the way. Any help anyone can offer would be greatly
appreciated. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Unusual routing problem
2003-03-24 18:25 Unusual routing problem Benjamin Tompkins
@ 2003-03-24 19:28 ` Kim Jensen
2003-03-30 19:00 ` Benjamin Tompkins
0 siblings, 1 reply; 6+ messages in thread
From: Kim Jensen @ 2003-03-24 19:28 UTC (permalink / raw)
To: Benjamin Tompkins; +Cc: netfilter
Hi Benjamin,
I have recently been playing with the same thing, and have a still unanswered
question regarding the possibility to combine MASQUERADING with NAT!
Anyway, if you keep things down to a simple level, then all you have to do is
create a second routing table (copy), and then add a fwmark rule to to tell
the routing system, that the second table should be used when the mark is
matched.
In your iptables, you mark all packets which are bound for your secondary
route. While the default set up will ensure that you have all packets running
through normally.
Ip routing rule:
$ ip rule add fwmark xxx table yyy
in iptables:
$ iptables -t mangle -A PREROUTING [conditions] -j MARK --set-mark xxx
Hopes this helps. However, if you manage to set up your system with working
masquerading & natting, please give me a hint - I'm completely stuck and are
currently resolving to using aliasing!
/Kim
On Monday 24 March 2003 19:25, Benjamin Tompkins wrote:
> I am attempting to route myself an ip block from my office to my home via a
> tunnel. Simple enough. The catch is, I only want the tunnel to be used for
> lan destined traffic and incoming connections to my IP block. The lan
> destined traffic is easy, the trick apparently is getting the block to be
> accessible via the internet, without forcing all traffic to use the tunnel.
> A diagram.
>
> eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
> \ /
> Linux Machine
>
> ppp0 (x.x.x.2/30)
>
> Ok, so what I have so far is as follows.
>
> This takes care of access to the office network.
> route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
> route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
> route add -host x.x.x.1 dev eth0
>
> Now to use the cable for everything else.
> iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
>
> So now I can access my office lan and vice versa, and everything else gets
> masqed out the cable. But I'm having a heck of a time letting the box to
> know that stuff requested via ppp0, needs to go out ppp0. I have looked at
> using the mangle table making rules for input and forward, but am just
> missing something along the way. Any help anyone can offer would be greatly
> appreciated. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Unusual routing problem
2003-03-24 19:28 ` Kim Jensen
@ 2003-03-30 19:00 ` Benjamin Tompkins
2003-03-31 16:52 ` Kim Jensen
0 siblings, 1 reply; 6+ messages in thread
From: Benjamin Tompkins @ 2003-03-30 19:00 UTC (permalink / raw)
To: netfilter
I've set this up and still having no luck. Responses to packets that come in
ppp0 are still going out eth0. Any other ideas on what I may be doing wrong?
Hi Benjamin,
I have recently been playing with the same thing, and have a still
unanswered
question regarding the possibility to combine MASQUERADING with NAT!
Anyway, if you keep things down to a simple level, then all you have to do
is
create a second routing table (copy), and then add a fwmark rule to to tell
the routing system, that the second table should be used when the mark is
matched.
In your iptables, you mark all packets which are bound for your secondary
route. While the default set up will ensure that you have all packets
running
through normally.
Ip routing rule:
$ ip rule add fwmark xxx table yyy
in iptables:
$ iptables -t mangle -A PREROUTING [conditions] -j MARK --set-mark xxx
Hopes this helps. However, if you manage to set up your system with working
masquerading & natting, please give me a hint - I'm completely stuck and are
currently resolving to using aliasing!
/Kim
On Monday 24 March 2003 19:25, Benjamin Tompkins wrote:
> I am attempting to route myself an ip block from my office to my home via
a
> tunnel. Simple enough. The catch is, I only want the tunnel to be used for
> lan destined traffic and incoming connections to my IP block. The lan
> destined traffic is easy, the trick apparently is getting the block to be
> accessible via the internet, without forcing all traffic to use the
tunnel.
> A diagram.
>
> eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
> \ /
> Linux Machine
>
> ppp0 (x.x.x.2/30)
>
> Ok, so what I have so far is as follows.
>
> This takes care of access to the office network.
> route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
> route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
> route add -host x.x.x.1 dev eth0
>
> Now to use the cable for everything else.
> iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
>
> So now I can access my office lan and vice versa, and everything else gets
> masqed out the cable. But I'm having a heck of a time letting the box to
> know that stuff requested via ppp0, needs to go out ppp0. I have looked at
> using the mangle table making rules for input and forward, but am just
> missing something along the way. Any help anyone can offer would be
greatly
> appreciated. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Unusual routing problem
2003-03-30 19:00 ` Benjamin Tompkins
@ 2003-03-31 16:52 ` Kim Jensen
0 siblings, 0 replies; 6+ messages in thread
From: Kim Jensen @ 2003-03-31 16:52 UTC (permalink / raw)
To: Benjamin Tompkins, netfilter
On Sunday 30 March 2003 21:00, Benjamin Tompkins wrote:
> I've set this up and still having no luck. Responses to packets that come
> in ppp0 are still going out eth0. Any other ideas on what I may be doing
> wrong?
>
Try to run some tcpdumps on your interfaces and look for traffic running
through, you can also try to log everything in pre/post routing. You can
also try to post part of your setup so it is possible to look at the problem.
Other than that, I can say that I have managed to get my system to work using
aliasing. It's not the solution I wished for, but at least traffic is flowing
correctly now. I'm still curious how to solve the problem using conntrack as
it simply doesn't work. At the moment, I fear that it may actually be kernel
bugs, which prevents this from working properly.
/Kim
>
> Hi Benjamin,
>
> I have recently been playing with the same thing, and have a still
> unanswered
> question regarding the possibility to combine MASQUERADING with NAT!
>
> Anyway, if you keep things down to a simple level, then all you have to do
> is
> create a second routing table (copy), and then add a fwmark rule to to tell
> the routing system, that the second table should be used when the mark is
> matched.
>
> In your iptables, you mark all packets which are bound for your secondary
> route. While the default set up will ensure that you have all packets
> running
> through normally.
>
> Ip routing rule:
> $ ip rule add fwmark xxx table yyy
>
> in iptables:
> $ iptables -t mangle -A PREROUTING [conditions] -j MARK --set-mark xxx
>
> Hopes this helps. However, if you manage to set up your system with working
> masquerading & natting, please give me a hint - I'm completely stuck and
> are currently resolving to using aliasing!
>
> /Kim
>
> On Monday 24 March 2003 19:25, Benjamin Tompkins wrote:
> > I am attempting to route myself an ip block from my office to my home via
>
> a
>
> > tunnel. Simple enough. The catch is, I only want the tunnel to be used
> > for lan destined traffic and incoming connections to my IP block. The lan
> > destined traffic is easy, the trick apparently is getting the block to be
> > accessible via the internet, without forcing all traffic to use the
>
> tunnel.
>
> > A diagram.
> >
> > eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
> > \ /
> > Linux Machine
> >
> > ppp0 (x.x.x.2/30)
> >
> > Ok, so what I have so far is as follows.
> >
> > This takes care of access to the office network.
> > route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
> > route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
> > route add -host x.x.x.1 dev eth0
> >
> > Now to use the cable for everything else.
> > iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
> >
> > So now I can access my office lan and vice versa, and everything else
> > gets masqed out the cable. But I'm having a heck of a time letting the
> > box to know that stuff requested via ppp0, needs to go out ppp0. I have
> > looked at using the mangle table making rules for input and forward, but
> > am just missing something along the way. Any help anyone can offer would
> > be
>
> greatly
>
> > appreciated. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Unusual routing problem
@ 2003-03-24 18:18 Benjamin Tompkins
2003-04-01 17:58 ` Matthew G. Marsh
0 siblings, 1 reply; 6+ messages in thread
From: Benjamin Tompkins @ 2003-03-24 18:18 UTC (permalink / raw)
To: netfilter
I am attempting to route myself an ip block from my office to my home via a
tunnel. Simple enough. The catch is, I only want the tunnel to be used for
lan destined traffic and incoming connections to my IP block. The lan
destined traffic is easy, the trick apparently is getting the block to be
accessible via the internet, without forcing all traffic to use the tunnel.
A diagram.
eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
\ /
Linux Machine
|
ppp0 (x.x.x.2/30)
Ok, so what I have so far is as follows.
This takes care of access to the office network.
route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
route add -host x.x.x.1 dev eth0
Now to use the cable for everything else.
iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
So now I can access my office lan and vice versa, and everything else gets
masqed out the cable. But I'm having a heck of a time letting the box to
know that stuff requested via ppp0, needs to go out ppp0. I have looked at
using the mangle table making rules for input and forward, but am just
missing something along the way. Any help anyone can offer would be greatly
appreciated. Thanks.
Benji
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Unusual routing problem
2003-03-24 18:18 Benjamin Tompkins
@ 2003-04-01 17:58 ` Matthew G. Marsh
0 siblings, 0 replies; 6+ messages in thread
From: Matthew G. Marsh @ 2003-04-01 17:58 UTC (permalink / raw)
To: Benjamin Tompkins; +Cc: netfilter
On Mon, 24 Mar 2003, Benjamin Tompkins wrote:
> I am attempting to route myself an ip block from my office to my home via a
> tunnel. Simple enough. The catch is, I only want the tunnel to be used for
> lan destined traffic and incoming connections to my IP block. The lan
> destined traffic is easy, the trick apparently is getting the block to be
> accessible via the internet, without forcing all traffic to use the tunnel.
> A diagram.
>
> eth0 (DHCP) cable modem eth1 (x.x.x.1/28) LAN
> \ /
> Linux Machine
> |
> ppp0 (x.x.x.2/30)
>
> Ok, so what I have so far is as follows.
>
> This takes care of access to the office network.
> route add -net x.x.x.1 netmask 255.255.255.240 dev eth1
> route add -net x.x.x.0 netmask 255.255.254.0 dev ppp0
> route add -host x.x.x.1 dev eth0
>
> Now to use the cable for everything else.
> iptables -A POSTROUTING -s x.x.x.1/28 -o eth0 -j MASQUERADE
>
> So now I can access my office lan and vice versa, and everything else gets
> masqed out the cable. But I'm having a heck of a time letting the box to
> know that stuff requested via ppp0, needs to go out ppp0. I have looked at
ip rule add from x.x.x.2 dev lo table pppout
Remember that the RPDB defines all packets as sourced from dev lo even
though they have the ip addr of the eventual outgoing interface.
> using the mangle table making rules for input and forward, but am just
> missing something along the way. Any help anyone can offer would be greatly
> appreciated. Thanks.
>
> Benji
>
>
--------------------------------------------------
Matthew G. Marsh, President
Paktronix Systems LLC
1506 North 59th Street
Omaha NE 68104
Phone: (402) 553-2288
Email: mgm@paktronix.com
WWW: http://www.paktronix.com
--------------------------------------------------
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-04-01 17:58 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-03-24 18:25 Unusual routing problem Benjamin Tompkins
2003-03-24 19:28 ` Kim Jensen
2003-03-30 19:00 ` Benjamin Tompkins
2003-03-31 16:52 ` Kim Jensen
-- strict thread matches above, loose matches on Subject: below --
2003-03-24 18:18 Benjamin Tompkins
2003-04-01 17:58 ` Matthew G. Marsh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox