* identical scripts, 2 boxes, different behavior - what else should i look for?!
@ 2004-03-16 19:11 arif
2004-03-16 19:31 ` Ray Anderson
0 siblings, 1 reply; 3+ messages in thread
From: arif @ 2004-03-16 19:11 UTC (permalink / raw)
To: netfilter
ok, after being super frustrated trying to figure out
why i can't forward ports properly, i decided to just
take the script we currently are using on the soon to
be old firewall, and load it onto the new one. It
loaded fine, but I get different behavior with the two
machines! I compared the rules line by line using
iptables -L, and theyre identical. But I do not get
forwarded to the internal hosts like I should, when I
try with the new machine! The routing tables are
identical also, and they both have the same kernel
modules loaded... the original is a 2.4.20 precompiled
redhat kernel, and the new one is 2.4.25 that i
compiled myself - could it be something i am missing
in the kernel?? or is there something else i should
check? i have /proc/sys/net/ipv4/ip_forward set to 1
of course.. i dont know what else to look for!!!
HELP!!! :)
__________________________________
Do you Yahoo!?
Yahoo! Mail - More reliable, more storage, less spam
http://mail.yahoo.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: identical scripts, 2 boxes, different behavior - what else should i look for?!
2004-03-16 19:11 identical scripts, 2 boxes, different behavior - what else should i look for?! arif
@ 2004-03-16 19:31 ` Ray Anderson
2004-03-16 20:06 ` arif
0 siblings, 1 reply; 3+ messages in thread
From: Ray Anderson @ 2004-03-16 19:31 UTC (permalink / raw)
To: 'arif', netfilter
Check the gateway on the internal machine you're trying to forward to.
Internal box a will only talk through 1 firewall at a time, or correct me if
I'm wrong.
Firewall1 , firewall 2
.
/|\
|
Box A
Gateway is
firewall 1
Incoming packet to internal box A through firewall 2 will not work because
box A tries to respond through firewall 1, not firewall 2.
Or did I completely misunderstand the question?
-=Ray
+-----------------------------------------------------------+
| | Ray Anderson |
| | | Systems Development Manager |
| | | 916.788.2444 (Office) |
| (O) | 916.798.9439 (Mobile) |
|X--------<_._>--------X | PRIDE Industries |
| (___) | rsa at prideindustries.com |
| | http://www.prideindustries.com |
+-----------------------------------------------------------+
It's the little things that cost you victories.
Group Captain Reade Tilley, RAF
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of arif
> Sent: Tuesday, March 16, 2004 11:11 AM
> To: netfilter@lists.netfilter.org
> Subject: identical scripts, 2 boxes, different behavior -
> what else should i look for?!
>
>
> ok, after being super frustrated trying to figure out
> why i can't forward ports properly, i decided to just
> take the script we currently are using on the soon to
> be old firewall, and load it onto the new one. It
> loaded fine, but I get different behavior with the two
> machines! I compared the rules line by line using
> iptables -L, and theyre identical. But I do not get
> forwarded to the internal hosts like I should, when I
> try with the new machine! The routing tables are
> identical also, and they both have the same kernel
> modules loaded... the original is a 2.4.20 precompiled
> redhat kernel, and the new one is 2.4.25 that i
> compiled myself - could it be something i am missing
> in the kernel?? or is there something else i should
> check? i have /proc/sys/net/ipv4/ip_forward set to 1
> of course.. i dont know what else to look for!!!
> HELP!!! :)
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - More reliable, more storage, less spam
> http://mail.yahoo.com
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: identical scripts, 2 boxes, different behavior - what else should i look for?!
2004-03-16 19:31 ` Ray Anderson
@ 2004-03-16 20:06 ` arif
0 siblings, 0 replies; 3+ messages in thread
From: arif @ 2004-03-16 20:06 UTC (permalink / raw)
To: Ray Anderson, netfilter
THANK YOU!!!!!!!!! that is exactly my problem, i was
sitting here playing with these rules for days and it
had nothing to do with them!!! it all makes sense
now! well, except that i'm not sure why i could get it
to work using MASQUERADE, even when the gateway was
the old firewall, i guess it just works differently
than SNAT :) THANKS AGAIN!!!!
--- Ray Anderson <rsa@rb-com.com> wrote:
> Check the gateway on the internal machine you're
> trying to forward to.
>
> Internal box a will only talk through 1 firewall at
> a time, or correct me if
> I'm wrong.
>
> Firewall1 , firewall 2
> .
> /|\
> |
>
> Box A
> Gateway is
> firewall 1
>
> Incoming packet to internal box A through firewall 2
> will not work because
> box A tries to respond through firewall 1, not
> firewall 2.
>
> Or did I completely misunderstand the question?
>
> -=Ray
>
+-----------------------------------------------------------+
> | | Ray Anderson
> |
> | | | Systems Development
> Manager |
> | | | 916.788.2444 (Office)
> |
> | (O) | 916.798.9439 (Mobile)
> |
> |X--------<_._>--------X | PRIDE Industries
> |
> | (___) | rsa at
> prideindustries.com |
> | |
> http://www.prideindustries.com |
>
+-----------------------------------------------------------+
> It's the little things that cost you victories.
> Group Captain Reade Tilley, RAF
>
>
> > -----Original Message-----
> > From: netfilter-admin@lists.netfilter.org
> > [mailto:netfilter-admin@lists.netfilter.org] On
> Behalf Of arif
> > Sent: Tuesday, March 16, 2004 11:11 AM
> > To: netfilter@lists.netfilter.org
> > Subject: identical scripts, 2 boxes, different
> behavior -
> > what else should i look for?!
> >
> >
> > ok, after being super frustrated trying to figure
> out
> > why i can't forward ports properly, i decided to
> just
> > take the script we currently are using on the soon
> to
> > be old firewall, and load it onto the new one. It
> > loaded fine, but I get different behavior with the
> two
> > machines! I compared the rules line by line using
> > iptables -L, and theyre identical. But I do not
> get
> > forwarded to the internal hosts like I should,
> when I
> > try with the new machine! The routing tables are
> > identical also, and they both have the same kernel
> > modules loaded... the original is a 2.4.20
> precompiled
> > redhat kernel, and the new one is 2.4.25 that i
> > compiled myself - could it be something i am
> missing
> > in the kernel?? or is there something else i
> should
> > check? i have /proc/sys/net/ipv4/ip_forward set
> to 1
> > of course.. i dont know what else to look for!!!
> > HELP!!! :)
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Mail - More reliable, more storage, less
> spam
> > http://mail.yahoo.com
> >
>
__________________________________
Do you Yahoo!?
Yahoo! Mail - More reliable, more storage, less spam
http://mail.yahoo.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-03-16 20:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-03-16 19:11 identical scripts, 2 boxes, different behavior - what else should i look for?! arif
2004-03-16 19:31 ` Ray Anderson
2004-03-16 20:06 ` arif
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox