lkml.org 
[lkml]   [1996]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject2.1.9 -> IP Forwarding?

Hello,

I'm having a few problems with 2.1.9. I'm using my machine as a
PPP/ethernet gateway that is masquerading a private network. I've been
doing this for months with no probs. However, I just recently made a few
changes, one being a kernel upgrade (2.1.9) and the other being a new
forewall script, and now things seem busted. Here are my problems:

1.) Direct ethernet connections from a private host to my
Linux firewall work, but horribly slowly. There is a latency such that
when I type across a telnet, characters won't appear on the screen until I
stop typing for a second. In fact, I wrote almost this entire paragrpah
before anything appeared on the screen (I'm logged in to my system from
one of the internal hosts).

2.) Masqueraded connections outbound no longer work; at all. I
can't describe it any other way than "nothing ever happens". I have built
the kernel correctly and I have the right filter rules. I will include my
kernel config file, my firewall rules (from ipfwadm-2.3.0) and a short
tcpdump session.

I've tried this with no input rules at all, forward set to accept, input
set to accept and masquerading on, but it has no effect. Thanks a lot to
anyone who can help out with this one. Take care,

-bp
--
# B. James Phillippe # System Administrator <Terran.ORG>
# <bryan@terran.org> # http://w3.terran.org/~bryan
# Finger for PGP key # Pro-Linux circa 1.1.59


First, my .config file for 2.1.9

#
# Automatically generated make config: don't edit
#

#
# Code maturity level options
#
CONFIG_EXPERIMENTAL=y

#
# Loadable module support
#
CONFIG_MODULES=y
# CONFIG_MODVERSIONS is not set
CONFIG_KERNELD=y

#
# General setup
#
# CONFIG_MATH_EMULATION is not set
CONFIG_NET=y
# CONFIG_MAX_16M is not set
CONFIG_PCI=y
CONFIG_PCI_OPTIMIZE=y
CONFIG_SYSVIPC=y
CONFIG_BINFMT_AOUT=m
CONFIG_BINFMT_ELF=y
CONFIG_BINFMT_JAVA=m
CONFIG_M686=y
CONFIG_VIDEO_SELECT=y
CONFIG_CYRIX=y
CONFIG_CYRIX_VSPM=y

#
# Floppy, IDE, and other block devices
#
CONFIG_BLK_DEV_FD=m
CONFIG_BLK_DEV_IDE=y

#
# Please see Documentation/ide.txt for help/info on IDE drives
#
# CONFIG_BLK_DEV_HD_IDE is not set
CONFIG_BLK_DEV_IDEDISK=y
CONFIG_BLK_DEV_IDECD=m
# CONFIG_BLK_DEV_IDETAPE is not set
# CONFIG_BLK_DEV_IDEFLOPPY is not set
# CONFIG_BLK_DEV_CMD640 is not set
# CONFIG_BLK_DEV_RZ1000 is not set
CONFIG_BLK_DEV_TRITON=y
# CONFIG_IDE_CHIPSETS is not set

#
# Additional Block Devices
#
CONFIG_BLK_DEV_LOOP=m
# CONFIG_BLK_DEV_MD is not set
CONFIG_BLK_DEV_RAM=m
# CONFIG_BLK_DEV_XD is not set
# CONFIG_BLK_DEV_HD is not set

#
# Networking options
#
CONFIG_FIREWALL=y
CONFIG_NET_ALIAS=y
CONFIG_INET=y
CONFIG_IP_FORWARD=y
# CONFIG_IP_MULTICAST is not set
CONFIG_IP_FIREWALL=y
CONFIG_IP_FIREWALL_VERBOSE=y
CONFIG_IP_MASQUERADE=y

#
# Protocol-specific masquerading support will be built as modules.
#
# CONFIG_IP_TRANSPARENT_PROXY is not set
CONFIG_IP_ALWAYS_DEFRAG=y
CONFIG_IP_ACCT=y
# CONFIG_IP_ROUTER is not set
# CONFIG_NET_IPIP is not set
CONFIG_IP_ALIAS=m

#
# (it is safe to leave these untouched)
#
# CONFIG_INET_PCTCP is not set
# CONFIG_INET_RARP is not set
# CONFIG_NO_PATH_MTU_DISCOVERY is not set
CONFIG_IP_NOSR=y
CONFIG_SKB_LARGE=y
# CONFIG_IPV6 is not set

#
#
#
# CONFIG_IPX is not set
# CONFIG_ATALK is not set
# CONFIG_AX25 is not set
# CONFIG_BRIDGE is not set
# CONFIG_NETLINK is not set

#
# SCSI support
#
# CONFIG_SCSI is not set

#
# Network device support
#
CONFIG_NETDEVICES=y
CONFIG_DUMMY=m
# CONFIG_EQUALIZER is not set
# CONFIG_DLCI is not set
# CONFIG_PLIP is not set
CONFIG_PPP=m

#
# CCP compressors for PPP are only built as modules.
#
# CONFIG_SLIP is not set
# CONFIG_NET_RADIO is not set
CONFIG_NET_ETHERNET=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_LANCE is not set
# CONFIG_NET_VENDOR_SMC is not set
CONFIG_NET_ISA=y
# CONFIG_AT1700 is not set
# CONFIG_E2100 is not set
# CONFIG_DEPCA is not set
# CONFIG_EWRK3 is not set
# CONFIG_EEXPRESS is not set
# CONFIG_EEXPRESS_PRO is not set
# CONFIG_FMV18X is not set
# CONFIG_HPLAN_PLUS is not set
# CONFIG_HPLAN is not set
# CONFIG_HP100 is not set
# CONFIG_ETH16I is not set
CONFIG_NE2000=m
# CONFIG_NI52 is not set
# CONFIG_NI65 is not set
# CONFIG_SEEQ8005 is not set
# CONFIG_SK_G16 is not set
# CONFIG_NET_EISA is not set
# CONFIG_NET_POCKET is not set
# CONFIG_TR is not set
# CONFIG_ARCNET is not set

#
# ISDN subsystem
#
# CONFIG_ISDN is not set

#
# CD-ROM drivers (not for SCSI or IDE/ATAPI drives)
#
# CONFIG_CD_NO_IDESCSI is not set

#
# Filesystems
#
CONFIG_QUOTA=y
CONFIG_MINIX_FS=m
CONFIG_EXT_FS=m
CONFIG_EXT2_FS=y
CONFIG_XIA_FS=m
CONFIG_FAT_FS=m
CONFIG_MSDOS_FS=m
CONFIG_VFAT_FS=m
CONFIG_UMSDOS_FS=m
CONFIG_PROC_FS=y
CONFIG_NFS_FS=m
CONFIG_SMB_FS=m
# CONFIG_SMB_LONG is not set
CONFIG_ISO9660_FS=m
# CONFIG_HPFS_FS is not set
# CONFIG_SYSV_FS is not set
# CONFIG_AFFS_FS is not set
# CONFIG_UFS_FS is not set

#
# Character devices
#
CONFIG_SERIAL=y
# CONFIG_DIGI is not set
# CONFIG_CYCLADES is not set
# CONFIG_STALDRV is not set
# CONFIG_RISCOM8 is not set
CONFIG_PRINTER=m
# CONFIG_MOUSE is not set
# CONFIG_UMISC is not set
# CONFIG_QIC02_TAPE is not set
CONFIG_FTAPE=m

#
# Set IObase/IRQ/DMA for ftape in ./drivers/char/ftape/Makefile
#
# CONFIG_APM is not set
# CONFIG_WATCHDOG is not set
CONFIG_RTC=y

#
# Sound
#
CONFIG_SOUND=m
# CONFIG_PAS is not set
CONFIG_SB=y
CONFIG_ADLIB=y
# CONFIG_GUS is not set
# CONFIG_MPU401 is not set
# CONFIG_UART6850 is not set
# CONFIG_PSS is not set
# CONFIG_GUS16 is not set
# CONFIG_GUSMAX is not set
# CONFIG_MSS is not set
# CONFIG_SSCAPE is not set
# CONFIG_TRIX is not set
# CONFIG_MAD16 is not set
# CONFIG_CS4232 is not set
# CONFIG_MAUI is not set
CONFIG_YM3812=y
SBC_BASE=220
SBC_IRQ=5
SBC_DMA=1
SB_DMA2=5
SB_MPU_BASE=330

#
# MPU401 IRQ is only required with Jazz16, SM Wave and ESS1688.
#

#
# Enter -1 to the following question if you have something else such as SB16/32.
#
SB_MPU_IRQ=-1
# CONFIG_LOWLEVEL_SOUND is not set

#
# Kernel hacking
#
# CONFIG_PROFILE is not set

------------------------------------------------------------------

Now my filter rules (from ipfwadm -Fle & -Ile)

IP firewall forward rules, default policy: accept
pkts bytes type prot opt tosa tosx ifname ifaddress source destination ports
16 704 acc/m all ---- 0xFF 0x00 any any localnet/24 anywhere n/a
0 0 acc/m all ---- 0xFF 0x00 any any ppp-net/24 anywhere n/a
(seperator)
IP firewall input rules, default policy: reject
pkts bytes type prot opt tosa tosx ifname ifaddress source destination ports
68 6838 acc all ---- 0xFF 0x00 any any anywhere localhost n/a
0 0 acc all ---- 0xFF 0x00 any any earth.terran.org earth.terran.org n/a
2939 122K acc all ---- 0xFF 0x00 eth0 any localnet/24 anywhere n/a
0 0 acc all ---- 0xFF 0x00 eth0 any ppp-net/24 anywhere n/a
22 5147 acc all -k-- 0xFF 0x00 any any anywhere anywhere n/a
0 0 rej udp ---o 0xFF 0x00 ppp0 any anywhere anywhere any -> sunrpc
0 0 rej tcp --yo 0xFF 0x00 ppp0 any anywhere anywhere any -> sunrpc
0 0 rej tcp --yo 0xFF 0x00 ppp0 any anywhere anywhere any -> X:6010
0 0 acc icmp ---o 0xFF 0x00 ppp0 any anywhere anywhere 8
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> ftp-data:ftp
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> ssh
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> telnet
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> smtp
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> domain
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> finger
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> www
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> pop-2:pop-3
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> ident
0 0 acc tcp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> imap
0 0 acc udp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> talk:ntalk
0 0 acc udp ---- 0xFF 0x00 any any anywhere earth.terran.org any -> 6970:7170

------------------------------------------------------------------

Now, the file I'm using to obtain these:

#!/bin/sh

IPFW=/sbin/ipfwadm

# Network variables
EVERYONE="0.0.0.0/0"
ROUTER="204.157.220.226"
LOCALNETS="localnet/24 ppp-net/24"

echo "Enabling IP Firewalling..."

############################################################################
# Accounting
#
# Keep a record of every packet and every byte that crosses our
# firewall.
#
${IPFW} -A -f
${IPFW} -A -a -P all -S ${ROUTER} -D ${EVERYONE}
${IPFW} -A -a -P all -S ${EVERYONE} -D ${ROUTER}
for net in ${LOCALNETS}; do
${IPFW} -A -a -P all -S ${net} -D ${EVERYONE}
done

############################################################################
# Forwarding
#
# Enable IP forwarding, and turn on IP-masquerading for desired
# internal networks.
#
${IPFW} -F -f
${IPFW} -F -p accept
for net in ${LOCALNETS}; do
${IPFW} -F -a masquerade -S ${net} -D ${EVERYONE}
done

############################################################################
# Input rules
#
# First, we set our firewall to block all inbound traffic that isn't
# coming from ourself or our internal networks.
#
${IPFW} -I -f
${IPFW} -I -p reject
${IPFW} -I -a accept -S ${EVERYONE} -D 127.0.0.1
${IPFW} -I -a accept -S ${ROUTER} -D ${ROUTER}
for net in ${LOCALNETS}; do
${IPFW} -I -a accept -S ${net} -W eth0
done
${IPFW} -I -a accept -k

# Logging
#
# Now let's log some of the nasty stuff. We're also logging
# ping (hope we have a big disk drive ;]
#
${IPFW} -I -a reject -o -P udp -D ${EVERYONE} 111 -W ppp0 # RPC
${IPFW} -I -a reject -oy -P tcp -D ${EVERYONE} 111 -W ppp0 # RPC
${IPFW} -I -a reject -oy -P tcp -D ${EVERYONE} 6000:6010 -W ppp0 # X
${IPFW} -I -a accept -o -P icmp -S ${EVERYONE} 8 -W ppp0 # ping

# Allow Well-Known Services
#
# Now we can begin allowing some inbound services.
#
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 20:21 # FTP
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 22 # ssh
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 23 # telnet
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 25 # SMTP
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 53 # DNS
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 79 # finger
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 80 # HTTP
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 109:110 # POP2/3
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 113 # auth
${IPFW} -I -a accept -P tcp -S ${EVERYONE} -D ${ROUTER} 143 # imap
${IPFW} -I -a accept -P udp -S ${EVERYONE} -D ${ROUTER} 517:518 # talk
${IPFW} -I -a accept -P udp -S ${EVERYONE} -D ${ROUTER} 6970:7170 # raudio

-----------------------------------------------------------------

Lastly, some tcpdump output showing what happens when my internal host
tries to connect to something on the net. No traffic ever reaches the
ppp0 interface, so this is all from eth0.

tcpdump: listening on eth0
04:38:40.038322 0:c0:d1:9:ff:3 null > earth-in sap 45 I (s=22,r=0,C) len=42
bb0e 4000 1f06 5e6c cc9d dce2 8c8e 0c43
ee4f 0017 0034 2a43 0000 0000 6002 2000
ee0c 0000 0204 05b4 2020 703a 206c 6973
7465
04:38:43.386338 0:c0:d1:9:ff:3 null > earth-in sap 45 I (s=22,r=0,C) len=42
be0e 4000 1f06 5b6c cc9d dce2 8c8e 0c43
ee4f 0017 0034 2a43 0000 0000 6002 2000
ee0c 0000 0204 05b4 2020 3065 2034 3030
3020




\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.025 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site