/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ I have a computer set up with two lines to the internet. I use iproute to assign clients to different lines. The clients routed over the first line work, the second line doesn't. The routing and firewall rules are all identical except for the ip addresses. A traceroute to an internet address from one of the clients using the second line shows the data going to the correct gateway but no further. I turned on the logging, ran tcpdump on the server, and tried to telnet out from the client. The tcpdump includes all data on the outgoing ethernet port and all data to and from the client. It appears that the server isn't demasquerading the incoming packets. Why? Here are the results: client: 192.168.1.8 server-outside1: 1.1.1.1 server-outside2: 2.2.2.2 server-inside: 3.3.3.3 Feb 11 10:32:44 node-d8e95862 kernel: Packet log: forward MASQ eth2 PROTO=6 192.168.1.8:1176 204.71.200.67:80 L=44 S=0x10 I=10516 F=0x4000 T=127 SYN (#1) 10:32:44.989634 192.168.1.8.1176 > www2.yahoo.com.www: S 62977:62977(0) win 8192 <mss 1460> (DF) [tos 0x10] 10:32:45.014764 1.1.1.1.63589 > www2.yahoo.com.www: S 62977:62977(0) win 8192 <mss 1460> (DF) [tos 0x10] Feb 11 10:32:45 node-d8e95862 kernel: Packet log: input ACCEPT eth2 PROTO=6 204.71.200.67:80 1.1.1.1:63589 L=44 S=0x00 I=38871 F=0x0000 T=54 (#20) 10:32:45.110078 www2.yahoo.com.www > 1.1.1.1.63589: S 1356122215:1356122215(0) ack 62978 win 17520 <mss 1460> run durring telnet: ipchains -M -L|grep yahoo TCP 01:56.06 192.168.1.8 www2.yahoo.com 1176 (63589) -> www masquerading configuration /sbin/ipchains -A forward -j MASQ -l -i eth2 -s 192.168.1.8/32 -d 0.0.0.0/0 /sbin/ipchains -A forward -j MASQ -i eth1 -s 192.168.1.0/24 -d 0.0.0.0/0 /sbin/ipchains -A forward -j REJECT -s 0.0.0.0/0 -d 0.0.0.0/0 -l routing configuration for second line clients 3.3.3.3 dev eth0 scope link window 16384 1.1.1.0/24 dev eth1 proto kernel scope link src 1.1.1.1 3.3.3.0/24 dev eth0 proto kernel scope link src 3.3.3.3 2.2.2.0/24 dev eth2 proto kernel scope link src 2.2.2.2 127.0.0.0/8 dev lo scope link window 8192 default via 2.2.2.200 dev eth2 window 16384 ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1 _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
