Modem to Ethernet Bridge

Modem to Ethernet Bridge

[Scott Ainslie]

I have a box with a network card(LAN) ip 192.168.0.25 subnet 192.168.0.0/24 
and has a modem for dial-in access which allocates 192.168.1.1 on this side 
and 192.168.1.2 to the client.

I am able to ping the LAN from the client and vice-versa and am able to http 
browse etc but I am not able to ftp, windows network browse etc.

Does anyone have any pointers on where to start? I simply want the dial-in 
client to be treated as safe and to have full access to the LAN.

Thanks


_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

Re: Modem to Ethernet Bridge

[Antony Stone]

On Thursday 05 September 2002 3:29 pm, Scott Ainslie wrote:

> I have a box with a network card(LAN) ip 192.168.0.25 subnet 192.168.0.0/24
> and has a modem for dial-in access which allocates 192.168.1.1 on this side
> and 192.168.1.2 to the client.
>
> I am able to ping the LAN from the client and vice-versa and am able to
> http browse etc but I am not able to ftp, windows network browse etc.
>
> Does anyone have any pointers on where to start? I simply want the dial-in
> client to be treated as safe and to have full access to the LAN.

SNAT the packets from 192.168.1.2 behind the 192.168.0.25 address.   Then 
other machines will be able to reply to your dial-in user (provided they can 
already reply to your box with the two interface as described above).

Something like:

iptables -A POSTROUTING -t nat -s 192.168.1.2 -j SNAT --to 192.168.0.25

should do the trick.

Antony.

-- 

If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.

Re: Modem to Ethernet Bridge

[Ramin Alidousti]

I don't see why a natted solution is required here. It's all basic
routing. Assuming all the hosts in the lan (192.168.0.0/24) have a
default route to 192.168.0.25 and the ppp host at 192.168.1.2 has
a default route to 192.168.1.1, then the linux box must be able to
forward packets back and forth between these two subnets.

You say that you can ping the lan from the client and vice-versa
which means that this basic setup is already in place. The reason
that you are not able to do ftp might be due to some filtering
which is going on on the linux box. Turn off the firewalling features
on the linux box and you'll be good to go for the routed protocols.

As for the windows network browsing, if I'm not wrong this does use
some netbios crap which is not routed meaning you need to bridge between
the ppp and the lan. In theory it is possible but I've not done the
bridging between a ppp link and an ethernet network and don't know
whether the linux bridging code suports that. You yourself can test
this ppp/ethernet bridging and see what happens and let us know.

Ramin

> > I have a box with a network card(LAN) ip 192.168.0.25 subnet 192.168.0.0/24
> > and has a modem for dial-in access which allocates 192.168.1.1 on this side
> > and 192.168.1.2 to the client.
> >
> > I am able to ping the LAN from the client and vice-versa and am able to
> > http browse etc but I am not able to ftp, windows network browse etc.
> >
> > Does anyone have any pointers on where to start? I simply want the dial-in
> > client to be treated as safe and to have full access to the LAN.
> 
> SNAT the packets from 192.168.1.2 behind the 192.168.0.25 address.   Then 
> other machines will be able to reply to your dial-in user (provided they can 
> already reply to your box with the two interface as described above).
> 
> Something like:
> 
> iptables -A POSTROUTING -t nat -s 192.168.1.2 -j SNAT --to 192.168.0.25
> 
> should do the trick.
> 
> Antony.
> 
> -- 
> 
> If you want to be happy for an hour, get drunk.
> If you want to be happy for a year, get married.
> If you want to be happy for a lifetime, get a garden.

re: Modem to Ethernet Bridge

[hard__ware]

Although this metod maybee hard at first it is a great experiance to learn..

Try using Portslave & Radius .. :D

hope this help :D

Bye ..  

Re: Modem to Ethernet Bridge

[Antony Stone]

On Thursday 05 September 2002 4:30 pm, Ramin Alidousti wrote:

> I don't see why a natted solution is required here.

I agree that a NATted solution is not *required*, however I think it should 
work and is therefore an effective solution to the problem.   Depending on 
the routing issues on other machines, it might well be the simplest solution, 
involving changes on only one machine.

> It's all basic routing. Assuming all the hosts in the lan (192.168.0.0/24)
> have a default route to 192.168.0.25

I didn't feel comfortable making that assumption, and it doesn't deal with 
machines other than those directly on the local network.

> and the ppp host at 192.168.1.2 has
> a default route to 192.168.1.1, then the linux box must be able to
> forward packets back and forth between these two subnets.

This route does seem reasonable, and I'm sure the linux box itself must be 
able to forward packets between the two networks.   However, this doesn't 
necessarily mean that other machines know to use 192.168.0.25 as the route to 
get to 192.168.1.2

If Scott's running another firewall somewhere on the LAN with a connection to 
the Internet, he might not SNAT packets from 192.168.1.2 as well as 
192.168.0.0/24 on their way out to the Internet, which would be needed in 
order to provide Internet access from this machine.

Antony.

-- 

Most people have more than the average number of legs.

Re: Modem to Ethernet Bridge

[Antony Stone]

On Thursday 05 September 2002 4:37 pm, hard__ware wrote:

> Although this metod maybee hard at first it is a great experiance to
> learn..
>
> Try using Portslave & Radius .. :D
>
> hope this help :D

Perhaps you could give a bit more information about this ?

1. Where do we find the Portslave and Radius software ?
2. Are there any good HOWTOs, FAQs, or other documentation for what you is 
quite a hard process ?
3. Are there any problems with the end result?

Antony.

-- 

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

Re: Modem to Ethernet Bridge

[Ramin Alidousti]

On Thu, Sep 05, 2002 at 04:40:59PM +0100, Antony Stone wrote:

> On Thursday 05 September 2002 4:30 pm, Ramin Alidousti wrote:
> 
> > I don't see why a natted solution is required here.
> 
> I agree that a NATted solution is not *required*, however I think it should 
> work and is therefore an effective solution to the problem.   Depending on 
> the routing issues on other machines, it might well be the simplest solution, 
> involving changes on only one machine.

So you mean, when he _can_ ping and _cannot_, eg, ftp; then an effective
solution to the problem is to nat????  Explain why.  

Ramin

Re: Modem to Ethernet Bridge

[Antony Stone]

On Thursday 05 September 2002 6:24 pm, Ramin Alidousti wrote:

> On Thu, Sep 05, 2002 at 04:40:59PM +0100, Antony Stone wrote:
> > On Thursday 05 September 2002 4:30 pm, Ramin Alidousti wrote:
> > > I don't see why a natted solution is required here.
> >
> > I agree that a NATted solution is not *required*, however I think it
> > should work and is therefore an effective solution to the problem.  
> > Depending on the routing issues on other machines, it might well be the
> > simplest solution, involving changes on only one machine.
>
> So you mean, when he _can_ ping and _cannot_, eg, ftp; then an effective
> solution to the problem is to nat????  Explain why.

Re-reading the original posting from Scott I now realise that he only wants 
the dial-up client to have access to his LAN machines - I had originally 
mistakenly read it that he wanted the remote client to have the same access 
(to anything) as his existing LAN machines.

I agree that so long as all his LAN systems know to route 192.168.1.2 via 
192.168.0.25 then he does not need NAT.

Obviously if he can ping and he can't ftp (between the same two machines) 
then NAT will not solve it, however his routing must be set up correctly as 
well, and therefore the protocol difficulty is almost certainly down to 
something in his firewall rules.

Antony.

-- 

How I want a drink, alcoholic of course, after the heavy chapters
involving quantum mechanics.

 - 3.14159265358979

Re: Modem to Ethernet Bridge

[Ramin Alidousti]

On Fri, Sep 06, 2002 at 01:37:06AM +1000, hard__ware wrote:

> Although this metod maybee hard at first it is a great experiance to learn..
> 
> Try using Portslave & Radius .. :D

Using Portslave & Radius to do what? :D

Ramin

> 
> hope this help :D
> 
> Bye ..  

Re: Modem to Ethernet Bridge

[Ramin Alidousti]

On Thu, Sep 05, 2002 at 06:09:14PM +0100, Antony Stone wrote:

> On Thursday 05 September 2002 4:37 pm, hard__ware wrote:
> 
> > Although this metod maybee hard at first it is a great experiance to
> > learn..
> >
> > Try using Portslave & Radius .. :D
> >
> > hope this help :D
> 
> Perhaps you could give a bit more information about this ?
> 
> 1. Where do we find the Portslave and Radius software ?
> 2. Are there any good HOWTOs, FAQs, or other documentation for what you is 
> quite a hard process ?
> 3. Are there any problems with the end result?
4. What do you want to solve anyway?

Ramin

> Antony.