Forwarding and masquerading got broken

Michael Gale said:

Hello,

Look the section"
--snip--
# --------( Sysctl Tuning - Recommended Parameters )--------

# Turn off IP forwarding by default
# (this will be enabled if you require masquerading)

if [ -e /proc/sys/net/ipv4/ip_forward ]; then
echo 0 > /proc/sys/net/ipv4/ip_forward
fi
--snip--

The "echo 0" in the "/proc/sys/net/ipv4/ip_forward" is disabling ip_forwarding -- which is need to forward packets.

Change the "echo 0" to "echo 1"

Mike:

Thanks for the suggestion. Note, though, that further down in the file there is a parallel section cating 1 to the same address to turn on kernel forwarding. I have checked the actual setting after boot up by lessing the address, and it is indeed already set to one. I'll check changing this line, but I suspect that this is not where my problem is.

Any other suggestions?

Lawrence G. Hunsicker
[email protected]

Hi folks,

I have a PREROUTING rule:
iptables -t nat -A PREROUTING -d $EXTERNALIP_1 -s some_external_IP -p 47 -j DNAT --to 192.168.0.19

How to add more source addresses which will be able to connect?

Thanks in advance

Remus

Add more rules like these that allow it.
Or maybe you compiled a new kernel with netfilter iprange support.
http://www.netfilter.org/documentation/pomlist/pom-combined.html#iprange

Gr,
Rob

Just add more rules with different -s some_external_IP's

--
Raymond Leach <[email protected]>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

A method that works well for me, and I use it extensively, is to place all your IP addresses in a text file, and feed the file to the script. With this method, all you need to do is update (edit) the text file as needed for adding or deleting IP's. For instance, if you wanted to sneak TFTP through the firewall (which I don't really recommend), you could add this rule:

####################################################################
# TFTP
####################################################################

# if TFTP enabled redirect to port 69 on internal TFTP server
if [ "$TFTP_SERVER" = "1" ] ;
then
	while read TRUSTED;
	do
		$IPT -t nat -A PREROUTING -p udp -s $TRUSTED
--destination-port 69 -i $FW_INET_IFACE -j LOG --log-level $LOG_LEVEL
--log-prefix "DNAT IN TFTP OK: "
		$IPT -t nat -A PREROUTING -p udp -s $TRUSTED
--destination-port 69 -i $FW_INET_IFACE -j DNAT --to-destination
$INTERNAL_TFTP:69
	done < $TRUSTED_LIST
fi

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Remus
Sent: Wednesday, December 03, 2003 12:27 AM
To: [email protected]
Subject: Port Forwarding

Hi folks,

I have a PREROUTING rule:
iptables -t nat -A PREROUTING -d $EXTERNALIP_1 -s some_external_IP -p 47 -j DNAT --to 192.168.0.19

How to add more source addresses which will be able to connect?

Thanks in advance

Remus

Thanks guys for the help. It help me.

I have another iptables setmark question.
This is a small part of my script:

The line below is OK
iptables -t mangle -A PREROUTING -i eth2 -s 10.105.105.0/24 -p tcp --dport 1723 -j MARK --set-mark 0x960

But how mark just IP port 47, because the line below does not I want. iptables -t mangle -A PREROUTING -i eth2 -s 10.105.105.0/24 -p 47 -j MARK --set-mark 0x960

ip rule add fwmark 0x960 table localvpn
ip route add default via $P2 dev eth0 table localvpn

Thanks in advance

Remus

----- Original Message -----
From: "Mark E. Donaldson" <[email protected]>
To: "'Remus'" <[email protected]>; <[email protected]>
Sent: Wednesday, December 03, 2003 4:27 PM
Subject: RE: Port Forwarding

for

through

47 -j