help with routing/firewall

help with routing/firewall

[Fred Gurn]

[-- Attachment #1: Type: text/plain, Size: 585 bytes --]

Hi,
I have set up suse linux as bridge/firewall.
Simple configuration. 
eth0 internet
eth1 local net
Everything accepted from eth1, nothing from eth0, traffic from eth1 is routed to internet.
IP forwarding is enabled.
From local net I can ping eth1 and eth0 (that means machine is routing packets), but I cant go outside eth0. Same happens when ther is no firewall. What's the problem with routing?
What comands can I use to monitor what is happening with packets?
 
Tahnks in advance.


---------------------------------
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing

[-- Attachment #2: Type: text/html, Size: 786 bytes --]

RE: help with routing/firewall

[Juan Hernandez]

[-- Attachment #1: Type: text/plain, Size: 1129 bytes --]

Mmm im not sure if we are able to help you that way. that would be
making the job for you I guess. correct me if I'm wrong. Read some
manuals, get a grip in netfilter and if you don't understand something,
we'll help you. 
 
Juan
 
 
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Fred Gurn
Sent: jueves, 18 de diciembre de 2003 14:01
To: netfilter@lists.netfilter.org
Subject: help with routing/firewall
 
Hi,
I have set up suse linux as bridge/firewall.
Simple configuration. 
eth0 internet
eth1 local net
Everything accepted from eth1, nothing from eth0, traffic from eth1 is
routed to internet.
IP forwarding is enabled.
From local net I can ping eth1 and eth0 (that means machine is routing
packets), but I cant go outside eth0. Same happens when ther is no
firewall. What's the problem with routing?
What comands can I use to monitor what is happening with packets?
 
Tahnks in advance.
  _____  

Do you Yahoo!?
New
<http://pa.yahoo.com/*http:/us.rd.yahoo.com/evt=21260/*http:/photos.yaho
o.com>  Yahoo! Photos - easier uploading and sharing

[-- Attachment #2: Type: text/html, Size: 8873 bytes --]

Re: help with routing/firewall

[Ian Hunter]

SuSE comes with a script called SuSEfirewall that automatically configures
things for you.  You probably don't want that if you're talking to folks on
this list.

See if you have iptables or ipchains -- type iptables-save and if you get
output, post it to the list and we'll see what SuSE is doing firewall wise.

----- Original Message ----- 
From: "Juan Hernandez" <alucard@kanux.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, December 18, 2003 1:08 PM
Subject: RE: help with routing/firewall


> Mmm im not sure if we are able to help you that way. that would be
> making the job for you I guess. correct me if I'm wrong. Read some
> manuals, get a grip in netfilter and if you don't understand something,
> we'll help you.
>
> Juan
>
>
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Fred Gurn
> Sent: jueves, 18 de diciembre de 2003 14:01
> To: netfilter@lists.netfilter.org
> Subject: help with routing/firewall
>
> Hi,
> I have set up suse linux as bridge/firewall.
> Simple configuration.
> eth0 internet
> eth1 local net
> Everything accepted from eth1, nothing from eth0, traffic from eth1 is
> routed to internet.
> IP forwarding is enabled.
> >From local net I can ping eth1 and eth0 (that means machine is routing
> packets), but I cant go outside eth0. Same happens when ther is no
> firewall. What's the problem with routing?
> What comands can I use to monitor what is happening with packets?
>
> Tahnks in advance.
>   _____
>
> Do you Yahoo!?
> New
> <http://pa.yahoo.com/*http:/us.rd.yahoo.com/evt=21260/*http:/photos.yaho
> o.com>  Yahoo! Photos - easier uploading and sharing
>

Re: help with routing/firewall

[Jeffrey Laramie]

[-- Attachment #1: Type: text/html, Size: 1419 bytes --]

Re: help with routing/firewall

[Jeffrey Laramie]

[-- Attachment #1: Type: text/html, Size: 1084 bytes --]

Re: help with routing/firewall

[Togan Muftuoglu]

* Ian Hunter; <ihunter@hunterweb.net> on 18 Dec, 2003 wrote:
>SuSE comes with a script called SuSEfirewall that automatically configures
>things for you.  You probably don't want that if you're talking to folks on
>this list.
>
>See if you have iptables or ipchains -- type iptables-save and if you get
>output, post it to the list and we'll see what SuSE is doing firewall wise.

http://sourceforge.net/projects/susefaq has an unofficial manual for
SuSEfirewall.

And no SuSUfirewall does not automatically configures anything
especially when it is  security :-)

-- 

Togan Muftuoglu

help with routing/firewall

[Togan Muftuoglu]

* Ian Hunter; <ihunter@hunterweb.net> on 18 Dec, 2003 wrote:
>SuSE comes with a script called SuSEfirewall that automatically configures
>things for you.  You probably don't want that if you're talking to folks on
>this list.
>
>See if you have iptables or ipchains -- type iptables-save and if you get
>output, post it to the list and we'll see what SuSE is doing firewall wise.

http://sourceforge.net/projects/susefaq has an unofficial manual for
SuSEfirewall.

And no SuSEfirewall does not automatically configures anything
especially when it is  security :-)

-- 

Togan Muftuoglu

RE: help with routing/firewall

[Rob Sterenborg]

> Simple configuration. 
> eth0 internet
> eth1 local net
> Everything accepted from eth1, nothing from eth0, 
> traffic from eth1 is routed to internet.
> IP forwarding is enabled.
> From local net I can ping eth1 and eth0 (that means 
> machine is routing packets), but I cant go outside 
> eth0. Same happens when ther is no firewall. What's 
> the problem with routing?
> What comands can I use to monitor what is happening 
> with packets?

So do your masq/snat rules look like ?

Should be something like :
(echo "0" > /proc/sys/net/ipv4/ip_forward)
iptables -P FORWARD DROP
iptables -A FORWARD -i eth1 -o eth0 -s <local_net> \
    -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s <local_net> \
    -j SNAT --to-source <inet_ip>     ** OR **
iptables -t nat -A POSTROUTING -o eth0 -s <local_net> \
    -j MASQUERADE
(echo "1" > /proc/sys/net/ipv4/ip_forward)

Gr,
Rob