Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in

  FAQ | Search | Memberlist | Usergroups | Statistics | Profile | Log in to check your private messages | Log in | Register

Gentoo Router - Interface Bonding & IPTables?
 View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Crimjob
Tux's lil' helper
Tux's lil' helper


Joined: 04 Dec 2006
Posts: 111
PostPosted: Mon Jan 24, 2011 2:16 pm    Post subject: Gentoo Router - Interface Bonding & IPTables? Reply with quote
Hello again all,

I recently wanted to give interface bonding a go and I seem to be having some issues. I have a current set of firewall rules with iptables set up to act as a router, with LAN as ETH1 and WAN as ETH0. This works fine when I only have the two interfaces.

I was thinking it would be simple enough, comment out individual interfaces, set up bonding, start the bonded interface, change iptable rules to suit, but apparently I was wrong.

I was able to comment out individual interfaces, set up and start bonding, at which point I'm still able to access the server no problem, but since iptables isn't running, no internet for my LAN.

This is where it seems to get tricky. I only have 4 mentions of eth1 in my iptables setup, and I changed all of those to bond0, loaded iptables, and I stay connected to SSH, can still browse the server locally etc., but still no internet for my LAN. I even tried allowing bond0, eth1, eth2 in iptables but no change.+

I really don't understand what I'm doing wrong here, it seems fairly straight forward. Is there something specific to be done to the bonded interface? Or something specific within iptables?

my /etc/conf.d/net
Code:

slaves_bond0="eth1 eth2"
config_bond0=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.0.0" )


and my iptables (which is currently configured for eth1, however I just replaced all mentions of eth1 with bond0 and nothing happens)
Code:

*nat
:PREROUTING ACCEPT [71839:7061900]
:POSTROUTING ACCEPT [216:51799]
:OUTPUT ACCEPT [26914:1842823]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.1:81
-A PREROUTING -i eth0 -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.3:81
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.1:10000
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10001 -j DNAT --to-destination 192.168.0.3:10000
-A PREROUTING -i eth0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.101:53
-A PREROUTING -i eth0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.0.101:53
-A PREROUTING -i eth0 -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.0.101:80
-A PREROUTING -i eth0 -p udp -m udp --dport 88 -j DNAT --to-destination 192.168.0.101:88
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074
-A PREROUTING -i eth0 -p udp -m udp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.102:443
-A PREROUTING -i eth0 -p tcp -m tcp --dport 5223 -j DNAT --to-destination 192.168.0.102:5223
-A PREROUTING -i eth0 -p udp -m udp --dport 3478 -j DNAT --to-destination 192.168.0.102:3478
-A PREROUTING -i eth0 -p udp -m udp --dport 3479 -j DNAT --to-destination 192.168.0.102:3479
-A PREROUTING -i eth0 -p udp -m udp --dport 3658 -j DNAT --to-destination 192.168.0.102:3658
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070
-A PREROUTING -i eth0 -p udp -m udp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10071 -j DNAT --to-destination 192.168.0.102:10071
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10072 -j DNAT --to-destination 192.168.0.102:10072
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10073 -j DNAT --to-destination 192.168.0.102:10073
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10074 -j DNAT --to-destination 192.168.0.102:10074
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10075 -j DNAT --to-destination 192.168.0.102:10075
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10076 -j DNAT --to-destination 192.168.0.102:10076
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10077 -j DNAT --to-destination 192.168.0.102:10077
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10078 -j DNAT --to-destination 192.168.0.102:10078
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10079 -j DNAT --to-destination 192.168.0.102:10079
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10080 -j DNAT --to-destination 192.168.0.102:10080
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.1:81
-A PREROUTING -i eth0 -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.3:81
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.1:10000
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10001 -j DNAT --to-destination 192.168.0.3:10000
-A PREROUTING -i eth0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.101:53
-A PREROUTING -i eth0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.0.101:53
-A PREROUTING -i eth0 -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.0.101:80
-A PREROUTING -i eth0 -p udp -m udp --dport 88 -j DNAT --to-destination 192.168.0.101:88
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074
-A PREROUTING -i eth0 -p udp -m udp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.102:443
-A PREROUTING -i eth0 -p tcp -m tcp --dport 5223 -j DNAT --to-destination 192.168.0.102:5223
-A PREROUTING -i eth0 -p udp -m udp --dport 3478 -j DNAT --to-destination 192.168.0.102:3478
-A PREROUTING -i eth0 -p udp -m udp --dport 3479 -j DNAT --to-destination 192.168.0.102:3479
-A PREROUTING -i eth0 -p udp -m udp --dport 3658 -j DNAT --to-destination 192.168.0.102:3658
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070
-A PREROUTING -i eth0 -p udp -m udp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10071 -j DNAT --to-destination 192.168.0.102:10071
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10072 -j DNAT --to-destination 192.168.0.102:10072
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10073 -j DNAT --to-destination 192.168.0.102:10073
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10074 -j DNAT --to-destination 192.168.0.102:10074
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10075 -j DNAT --to-destination 192.168.0.102:10075
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10076 -j DNAT --to-destination 192.168.0.102:10076
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10077 -j DNAT --to-destination 192.168.0.102:10077
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10078 -j DNAT --to-destination 192.168.0.102:10078
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10079 -j DNAT --to-destination 192.168.0.102:10079
-A PREROUTING -i eth0 -p tcp -m tcp --dport 10080 -j DNAT --to-destination 192.168.0.102:10080
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Dec 21 18:09:58 2010
# Generated by iptables-save v1.4.6 on Tue Dec 21 18:09:58 2010
*mangle
:PREROUTING ACCEPT [34484662:33409678325]
:INPUT ACCEPT [638453:230510278]
:FORWARD ACCEPT [33831166:33163141834]
:OUTPUT ACCEPT [543482:124765518]
:POSTROUTING ACCEPT [34374661:33287927445]
COMMIT
# Completed on Tue Dec 21 18:09:58 2010
# Generated by iptables-save v1.4.6 on Tue Dec 21 18:09:58 2010
*filter
:INPUT DROP [78:4804]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [33160:2135658]
:THRU - [0:0]
-A INPUT -s 127.0.0.0/8 -i eth0 -j DROP
-A INPUT -s 192.168.0.0/16 -i eth0 -j DROP
-A INPUT -s 172.16.0.0/12 -i eth0 -j DROP
-A INPUT -s 10.0.0.0/8 -i eth0 -j DROP
-A INPUT ! -i eth1 -p udp -m udp --dport 67 -j REJECT --reject-with icmp-port-unreachable
-A INPUT ! -i eth1 -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -f -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j THRU
-A FORWARD -d 192.168.0.0/16 -i eth1 -j DROP
-A FORWARD -s 192.168.0.0/16 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.0.0/16 -i eth0 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 81 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 82 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 88 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 3074 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 3074 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 3478 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 3479 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 3658 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 5223 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 9293 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10000 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10001 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10070 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 10070 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10071 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10072 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10073 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10074 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10075 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10076 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10077 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10078 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10079 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10080 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 30595 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 58222:58333 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 6881 -j ACCEPT
COMMIT


_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley
Back to top
View user's profile Send private message
richard.scott
Veteran
Veteran


Joined: 19 May 2003
Posts: 1497
Location: Oxfordshire, UK
PostPosted: Mon Jan 24, 2011 4:31 pm    Post subject: Reply with quote
I don't think you've set a default gateway for bond0
Back to top
View user's profile Send private message
Crimjob
Tux's lil' helper
Tux's lil' helper


Joined: 04 Dec 2006
Posts: 111
PostPosted: Mon Jan 24, 2011 10:58 pm    Post subject: Reply with quote
Don't have one set for eth1 unbonded either and it's working fine?

My WAN interface is currently dynamic IP, not sure what I'd put for route.

Rest of my conf.d/net
Code:

config_eth0=( "dhcp" )
config_eth1=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.0.0" )

_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley
Back to top
View user's profile Send private message
Hu
Administrator
Administrator


Joined: 06 Mar 2007
Posts: 23193
PostPosted: Tue Jan 25, 2011 3:15 am    Post subject: Re: Gentoo Router - Interface Bonding & IPTables? Reply with quote
It appears your nat rules are all duplicated. Additionally, you could combine many of your rules into simpler ones by using the ability to match a range of contiguous ports and the ability to omit a destination port on the DNAT target, thereby preserving the original destination port.

Your rule THRU is written as though it were to permit traffic which you are NATing, but you attached it to INPUT instead of FORWARD. Additionally, many of the THRU rules could benefit from consolidation via use of contiguous ports.
Back to top
View user's profile Send private message
Crimjob
Tux's lil' helper
Tux's lil' helper


Joined: 04 Dec 2006
Posts: 111
PostPosted: Tue Jan 25, 2011 4:16 am    Post subject: Reply with quote
Yeah my rules are a bit of a hack job, and they may have been duplicated during a network outage in attempt of a speedy recovery. I am also not overly knowledgeable with IPTables, as I have not found a solid resource which accomplishes what I want to do for an example to work off of, and as such, this is pretty much a combination of the many tutorials I've found on the net.

I should be able to consolidate them, but I'm a bit confused on your other notes, as well as the fact that this current config works with eth1 but not bond0.

Would I just change
Code:
-A INPUT -j THRU

to
Code:
-A FORWARD -j THRU

?

And per your DNAT comment, something like
Code:
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80

to
Code:
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1

?
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley
Back to top
View user's profile Send private message
Hu
Administrator
Administrator


Joined: 06 Mar 2007
Posts: 23193
PostPosted: Wed Jan 26, 2011 3:07 am    Post subject: Reply with quote
Yes, to both of your questions.
Back to top
View user's profile Send private message
Crimjob
Tux's lil' helper
Tux's lil' helper


Joined: 04 Dec 2006
Posts: 111
PostPosted: Wed Jan 26, 2011 1:25 pm    Post subject: Reply with quote
Thank you sir! That definitely helped, quite a bit of browsing laggyness disappeared with that forward change.

I'll see what I can do for consolidation / cleaning up to make it a bit more clear, then I'll try to re-visit interface bonding.
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



 Links: forums.gentoo.org | www.gentoo.org | bugs.gentoo.org | wiki.gentoo.org | forum-mods@gentoo.org

Copyright 2001-2025 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy