| View previous topic :: View next topic |
| Author |
Message |
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
 Posted: Thu Jun 26, 2003 8:03 pm Post subject: Forbid eth0 to access 192.168.0.x |
 |
|
| How can I do it so my eth0 can't access the 192.168.0.x adresses? |
|
| Back to top |
|
 |
devon
l33t
Joined: 23 Jun 2003
Posts: 943
|
| Posted: Thu Jun 26, 2003 8:05 pm Post subject: |
|
|
| Without more details, I would say iptables. |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Thu Jun 26, 2003 8:10 pm Post subject: |
|
|
| No. What happens is that I want to block the access of eth0 before bringing it up... this is because there is a LAN DHCP server running and I want this interface to get IP from the ISP's DHCP server and not from the LAN's DHCP server. |
|
| Back to top |
|
|
devon
l33t
Joined: 23 Jun 2003
Posts: 943
|
| Posted: Thu Jun 26, 2003 8:32 pm Post subject: |
|
|
| Quote: | | this is because there is a LAN DHCP server running and I want this interface to get IP from the ISP's DHCP server and not from the LAN's DHCP server. |
On your LAN DHCP server, would it be possible to configure it so that it ignores DHCP requests from the MAC address of eth0? |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Thu Jun 26, 2003 8:35 pm Post subject: |
|
|
Nice idea! I'll try it!
But still I'd like that it would be the client that refuses the server rather than reverse... nevermind... if somebody knows anything, it might be posted  |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Thu Jun 26, 2003 8:48 pm Post subject: |
|
|
 Problem
How do I tell in dhcpd.conf that I want dhcpd to ignore a determined MAC address? There seems to be no such option in the dhcpd.conf man page...  |
|
| Back to top |
|
|
devon
l33t
Joined: 23 Jun 2003
Posts: 943
|
| Posted: Fri Jun 27, 2003 1:26 am Post subject: |
|
|
Seach the man page for dhcpd.conf for known/unknown hosts. You could probably make a HOST declaration for the server that should not DHCP and then set "ignore known". Something like:
| Code: | host nodhcp {
hardware ethernet <MAC Address>;
}
subnet <IP> netmask <mask> {
pool {
options...
ignore known clients;
}
} |
Also look at /etc/dhcp/dhcpd.conf.sample |
|
| Back to top |
|
|
cdunham
Apprentice
Joined: 06 Jun 2003
Posts: 211
Location: Rhode Island
|
| Posted: Fri Jun 27, 2003 3:22 am Post subject: |
|
|
| Is this box a bridge/router/firewall between the ISP network and the LAN? If so, you should be able to get DHCP from one interface for the LAN, and another from the ISP on the other interface... |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Fri Jun 27, 2003 6:27 am Post subject: |
|
|
| cdunham wrote: | | Is this box a bridge/router/firewall between the ISP network and the LAN? If so, you should be able to get DHCP from one interface for the LAN, and another from the ISP on the other interface... |
This is why I'm doing all this, my dear friend  |
|
| Back to top |
|
|
devon
l33t
Joined: 23 Jun 2003
Posts: 943
|
| Posted: Fri Jun 27, 2003 6:31 am Post subject: |
|
|
Does this not work in /etc/conf.d/net?
| Code: | iface_eth0="dhcp"
iface_eth1="dhcp" |
This assumes your ISP connections plugs directly into either eth0 or eth1 and a switch/hub plugs into the other interface to share the Internet with your client PCs. |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Fri Jun 27, 2003 3:19 pm Post subject: |
|
|
Diagram:
1.Athlon XP
eth0 (LAN DHCP SERVER)
eth1 (ISP DHCP)
2.K6-2
eth0 (ISP DHCP)
eth1 (LAN DHCP)
3.Pentium-IV
eth0 (LAN DHCP)
So 1.eth1 and 2.eth0 have to get DHCP IP from ISP.
1.eth0 is the LAN DHCP SERVER while 2.eth1 and 3.eth0 are LAN DHCP CLIENTS.
This happens because my ISP gives only 2 IP address for a single connection (won't enter on hardware configuration details), so the other interfaces with LAN IP must access the internet through the 1.eth1 gateway (although 2.eth1 won't use it as there is already such access). Nevermind, I'll configure dhcp server to ignore 2.eth0.
This topic is related with this one too (perhaps a moderator could merge both themes or so...) https://forums.gentoo.org/viewtopic.php?t=63498&start=0&postdays=0&postorder=asc&highlight=
This is because linux cuts gateway connection (while windowz doesn't) while there's inactivity. It's not totally related with this topic but it's the same interface on the same computer. |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Fri Jun 27, 2003 3:25 pm Post subject: |
|
|
| devon wrote: | Does this not work in /etc/conf.d/net?
| Code: | iface_eth0="dhcp"
iface_eth1="dhcp" |
This assumes your ISP connections plugs directly into either eth0 or eth1 and a switch/hub plugs into the other interface to share the Internet with your client PCs. |
No... it isn't like that. Look:
1.eth0, 1.eth1, 2.eth0, 2.eth1 and 3.eth0 are in te same SWITCH where the uplink is the cable-modem. As I explaned above, my ISP gives 2 IPs for each internet connection. I also do this so IPX protocol keeps all interfaces visible 'inside the switch'. Although I've been unable to find a program like samba for IPX (formerly there was a way, but just no longer)... but that's another topic.
Nevermind, I'll do that dhcp server client banning configuration for my LAN... and then I'll try to hack with those ARP tables... I still remark that this doesn't happen on windowze (or while the gateway is windowze, say it as you want). |
|
| Back to top |
|
|
cdunham
Apprentice
Joined: 06 Jun 2003
Posts: 211
Location: Rhode Island
|
| Posted: Fri Jun 27, 2003 3:44 pm Post subject: |
|
|
Perhaps I could suggest a better setup, one familiar to most of the rest of us doing this:
Machine A (two network cards):
eth0 - connection to ISP (not through switch) - dhcp
eth1 - lan dhcp - connected to switch
Does NAT with iptables
All Other Machines:
lan dhcp
connected to switch
one network card
You can make your setup work, but it's kind of a pain for what you need, I think.
_________________
This post more meaningful in a scalar context. |
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Fri Jun 27, 2003 3:49 pm Post subject: |
|
|
| cdunham wrote: | Perhaps I could suggest a better setup, one familiar to most of the rest of us doing this:
Machine A (two network cards):
eth0 - connection to ISP (not through switch) - dhcp
eth1 - lan dhcp - connected to switch
Does NAT with iptables
All Other Machines:
lan dhcp
connected to switch
one network card
You can make your setup work, but it's kind of a pain for what you need, I think. |
Look. I know it seems intelligent but if my ISP gives me 2 IP addresses I want to use them. Let's say it's for environmental reasons (all my comps are inside my bedroom ) So I can't have the main computer powered on when I sleep because it's too noisy, while others are silent. So, imagine I want to have my laptop and my other computer online... As far as there is an eth with a public internet IP up, both will be connected... just please, don't tell me about recommendations, give me a solution to my configuration which WORKS UNDER WINDOWZE AS I SAID BEFORE... mmmm if you have a look at this theme: https://forums.gentoo.org/viewtopic.php?t=63498&start=0&postdays=0&postorder=asc&highlight= you'll see someone already has given me a solution for this... it seems that some things don't work as they should so I'll just add that MANUAL ARP entry and I hope problem will solve. You'll have news from me after when I REBOOT!
|
|
| Back to top |
|
|
Deathwing00
Bodhisattva
Joined: 13 Jun 2003
Posts: 4087
Location: Dresden, Germany
|
| Posted: Fri Jun 27, 2003 7:39 pm Post subject: |
|
|
Thank you very much to everybody! I realized that gentoo has the arping and that ARP does solve the problem as I expected!  SO I just run at start this simple script...
| Code: | # arping -q 192.168.0.2 &
# arping -q 192.168.0.3 &
|
Thanks a lot to everybody!
BTW, I don't need the dhcp server now
The job the shcp server was supposed to do, (not really such dhcp but keeping up the LAN, has been satisfied with that... ) |
|
| Back to top |
|
|
|
Networking & Security
