[SOLVED] Ip MASQUERADING not working... [NOW WORKING!]

edux · Last edited by edux on Fri Nov 17, 2006 10:48 pm; edited 1 time in total

This problem makes me crazy!!!
I've done exactly what all iptables tutorials around the world say, but still I don't get what I want!
I got a PC (PC1) connected to a server on this lan: 192.168.1.0/24, with eth1 interfcace.
Now I connect another PC (PC2) to the first, on eth0, with a cross cable, and I create a new lan between the two PC's, lan2: 192.168.2.0/24.
Ping between the two PC's work. Ping between PC2 and server doesn't work.
I set ip_forwarding to 1. I set MASQUERADING policies correctly. I set PC2's gateway to PC1. I have also corrected PC2's arp table by hand to avoid arp requests! But still it doesn't work...
And the most incredible thing is, I connected an IPAQ with Familiar Linux to PC1's usbnet, and with the same settings I can reach the server from IPAQ!!!
IPAQ and PC2 have exactly the same settings, except for the ip address (IPAQ is on lan 192.168.5.0/24).

Please someone help me, I'm going crazy.......
_________________
E' la seconda più grande testa di scimmia che abbia mai visto!
(Guybrush Threepwood)

ping-uino · n00b Joined: 19 Nov 2005 Posts: 40 Location: Italy

Uhm. the picture is not very clear... (for me :-)

)

what's the class of ip of server? which ip has each pc?

if i get all things, the picture is:

[server] <--> (eth1)[PC1](eth0) <--> [PC2]
192.168.1.0/24 192.168.2.0/24

PC1 can reach server
PC1 can reach PC2
PC2 can reach PC1
PC2 doesn't reach server

it smells like a routing table problem. Does PC1 know where is PC2? What's the default gateway?
try to sniff traffic on PC1 with tcpdump to understand what is happening.
and check the route with netstat -rn

probably your tutorial is very old, because MASQUERADING is suggest only for dynamic ip natting,
use snat e dnat instead.
_________________
#ping -Ui 1 -n 0
(sorry for my bad english... my italian is far better!)

edux · Posted: Fri Nov 17, 2006 9:09 pm Post subject:

edux · Posted: Fri Nov 17, 2006 9:13 pm Post subject:

This is the routing table of PC2:

kadeux · Tux's lil' helper Joined: 21 Nov 2005 Posts: 103

It would be helpful if you can show us:
- your firewall script,
- the output of "/sbin/iptables -L -n -v" and "/sbin/iptables -t nat -L -n -v",
- the output of "route -n" for pc1, pc2 and the server,
- the output of "ifconfig -a" for pc1, pc2 and the server.

And please explain your intention to use a masquerading policy on pc1. Where is the WAN connection (that you mentioned in your second post) in the whole picture? And what have you done to the arp table of pc2 ?

Edit: Oh, you have already posted some information while I was writing. Please give even more information. :wink:

Corona688 · Veteran Joined: 10 Jan 2004 Posts: 1204

I'd actually reccomend firehol for setting up masquerade, firewalls, etc. It's in portage, and works without having to program in the network-equivalent of assembly language.
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html

kadeux · Tux's lil' helper Joined: 21 Nov 2005 Posts: 103

edux · Posted: Fri Nov 17, 2006 9:42 pm Post subject:

Server ip: 192.168.1.100
PC1 ip: eth1(->server):192.168.1.101 eth0(->PC2): 192.168.2.101

No firewall script, simply on PC1:

edux · Posted: Fri Nov 17, 2006 9:45 pm Post subject:

Is the new routing table correct?
_________________
E' la seconda più grande testa di scimmia che abbia mai visto!
(Guybrush Threepwood)

edux · Posted: Fri Nov 17, 2006 10:17 pm Post subject:

Solved. Wait a minute and I'll post why...
_________________
E' la seconda più grande testa di scimmia che abbia mai visto!
(Guybrush Threepwood)

edux · Posted: Fri Nov 17, 2006 10:31 pm Post subject:

Ok, I was wrong with PC2's routing table.
Now, from PC2, I can ping server and router. But now I can't ping a WAN ip...
_________________
E' la seconda più grande testa di scimmia che abbia mai visto!
(Guybrush Threepwood)

edux · Posted: Fri Nov 17, 2006 10:47 pm Post subject:

I WIN!!!!!

In the end, and for ever, here's the correct routing table for PC2: