/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Thanks for the pointers, I have been reading up on ipchains and feel much
more comfortable with it. And it appears that you may be right about the
fragmentation thing. I have found that any packets arriving on the LAN side
of the RH6.1 machine (mtu 1500) that are larger than the RH6.1-->RH5.2 link
will permit (mtu 1400) are being lost. I am still trying to pinpoint the
exact problem, but you have helped point me in the right direction, thanks!
Andreas M. Camacho
Software Engineer
[EMAIL PROTECTED]
(707)792-5390 X15
-----Original Message-----
> IPChains Configuration in rc.local on RH6.1:
> #Base ipchains config
> ipchains -M -S 7200 10 160
> ipchains -P forward DENY
>
> #Enable forwarding for the two subnets
> ipchains -A forward -s 192.168.50.0/24 -j MASQ
> ipchains -A forward -s 192.168.40.0/24 -j MASQ
This says to masq all packets arriving from the above address ranges and
destined for external addresses (hence forwarding).
> #Allow subnets to talk to eachother
> #I don't honestly know why this is here, I have been assured that it
must
> ipchains -A forward -i eth1 -d 192.168.50.0/30
> ipchains -A forward -i eth1 -d 192.168.40.0/30
>
> #Allow subnets to reach the internet
> ipchains -A forward -j MASQ -i eth0 -s 192.168.50.0/24 -d 0.0.0.0/0
> ipchains -A forward -j MASQ -i eth0 -s 192.168.40.0/24 -d 0.0.0.0/0
No packets ever reach these two. You can check this yourself by making some
connections to the Internet from your "masqed" boxes and then typing
"ipchains -L -v". It will show you how many packets matched each rule.
> when attempting to
> download large ftp files or use the WWW (again usually on larger files
like
> banner ads).
Maybe this is caused by packet fragmentation. I don't know though....
-- Michael Best
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
