| View previous topic :: View next topic |
| Author |
Message |
wolf_99
Apprentice
Joined: 22 Oct 2003
Posts: 213
|
 Posted: Fri Dec 30, 2005 9:38 pm Post subject: Home router setup problem |
 |
|
Hi!
I am trying to set up a home router, and having problems with it. I folowed the home router how-to (http://www.gentoo.org/doc/en/home-router-howto.xml) and encouterd no problems (no errors, warning weird cryptic messages etc.) But I don't recive packages (tcp/ip) from the net.
Here is what I have:
eth1 - connected to the Internet (WAN)
eth0 - connected to my main Gentoo box (LAN)
From my router box (an old PII) I can serf allright (good old lynx).
But when I ping from my main box to the net (yahoo.com) I don't get a reply.
Using the Nast sniffer I can see that the router gets the package and forwords it to the net
| Code: |
#nast -i ppp0 -p -f "src 192.168.2.75"
---[ ICMP ]----------------------------------------------------------
192.168.2.75 -> 216.109.117.204
Version: 4 Lenght: 84 TTL: 63
Type: Echo request
Packet Number: 45
|
Any one know's were I went wrong?
my iptables rules...
| Code: |
router ~ # iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
REJECT udp -- anywhere anywhere udp dpt:bootps reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpts:0:1023
DROP udp -- anywhere anywhere udp dpts:0:1023
Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere 192.168.0.0/16
ACCEPT all -- 192.168.0.0/16 anywhere
ACCEPT all -- anywhere 192.168.0.0/16
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
|
thanx
_________________
To err is human. To really fuck up, use a computer. |
|
| Back to top |
|
 |
frostschutz
Advocate
Joined: 22 Feb 2005
Posts: 2977
Location: Germany
|
| Posted: Fri Dec 30, 2005 10:05 pm Post subject: Re: Home router setup problem |
|
|
| wolf_99 wrote: | | But when I ping from my main box to the net (yahoo.com) I don't get a reply. |
Pinging webservers is a very bad way of testing things, since it's quite common to just not send any ping reply. I don't get a ping reply from yahoo.com either. |
|
| Back to top |
|
|
wolf_99
Apprentice
Joined: 22 Oct 2003
Posts: 213
|
| Posted: Fri Dec 30, 2005 10:28 pm Post subject: |
|
|
But I can't serf either, so it's not that.
When I ping from the router, I do get a pong back...
Any way's, the problem still exists, I can't connect to the net. Why?
_________________
To err is human. To really fuck up, use a computer. |
|
| Back to top |
|
|
desultory
Bodhisattva
Joined: 04 Nov 2005
Posts: 9410
|
| Posted: Fri Dec 30, 2005 10:38 pm Post subject: |
|
|
| You should have an established/related accept clause at the head of your forwarding chain. |
|
| Back to top |
|
|
wolf_99
Apprentice
Joined: 22 Oct 2003
Posts: 213
|
| Posted: Sat Dec 31, 2005 9:57 am Post subject: |
|
|
| Quote: |
You should have an established/related accept clause at the head of your forwarding chain.
|
Ho do I set that up?
_________________
To err is human. To really fuck up, use a computer. |
|
| Back to top |
|
|
tuxmin
l33t
Joined: 24 Apr 2004
Posts: 838
Location: Heidelberg
|
| Posted: Sat Dec 31, 2005 10:18 am Post subject: |
|
|
To get things working quickly I'd advise to use a graphical firewall tool like firestarter or fwbuilder. Many Gentoo folks like shorewall (but I don't know this one). You also can be sure that these tools build proper rulesets -- this is a rather hairy job for an iptables newbie..
I especially like fwbuilder. You can run it on a LAN box and update the ruleset via ssh. But for the start it could help you to build a basic ruleset which you could transfer to your router and execute it.
Firestarter is fine for running on the router itself. You could either access it via X11 forwarding, vnc or NX.
Hth, Alex!!!
_________________
ALT-F4 |
|
| Back to top |
|
|
desultory
Bodhisattva
Joined: 04 Nov 2005
Posts: 9410
|
| Posted: Sat Dec 31, 2005 4:01 pm Post subject: |
|
|
| Another good option for setting up a firewall is bastille, it is well and integrally documented, easy to set up and you can choose from either a gui (X) or a curses (shell) based interface. |
|
| Back to top |
|
|
|
Networking & Security
