Linux Networking problem...please help..
Netmask is 255.255.255.0 on all machines.
Point is that the WinXP machine is being given a
redirect by the Linux firewall and that is being
ignored, either due to inability of WinXP or some
misconfiguration by me.
Sanjay.
Quoted 58 lines · --- Stephen Samuel
What are the netmasks for the two machines?? If you give them a /18
(or a /16) netmask and the associated broadcast addresses, then they'll
know to just talk directly to each other.Of course, I barely trust Windows to understand netmasks, but it
should be OK -- far better than trying to get it to accept ICMP
redirects.Quoted 1 line · Sanjay Arora
Network Scenario: RH 8 Linux Firewall Server using
three ethernet cards,
Quoted 1 line
IPs 172.16.0.141 (connected to Cable Ethernet ISP
doing NAT),
Quoted 1 line
192.168.200.1 connected to an ethernet hub, &
192.168.100.1 (presently
Quoted 1 line
not being used). Using a hub two lans are
connected to 192.168.200.1,
Quoted 1 line
each presently having one machine each having IP
addresses 192.168.200.2
Quoted 1 line
(Windows XP machine, having Gateway address of
192.168.200.1 in TCP/IP
Quoted 1 line
settings) and 192.168.250.1 (RH8 Linux Server,
again having
Quoted 3 lines
192.168.200.1 as GW address).
1. When I ftp from 192.168.200.2 (WinXP) to
192.168.250.1 (RH Linux File
Quoted 1 line
Server), the firewall shows an error message
saying that WinXP machine
Quoted 1 line
is ignoring redirects to 192.168.250.1 The
transfer speed is also around
Quoted 1 line
3.5 MB instead of full 10 MB which I get between
the two Linux Servers.
Quoted 1 line
What's the reason? What do I do to correct this
behaviour?
Quoted 2 lines
2. The RH fileserver machine is very
underutilized. I am thinking of
Quoted 1 line
putting another ethernet card in it and connect is
to the cable ISP and
Quoted 1 line
Firewall server using a hub. I plan to put a
firewall on the new
Quoted 1 line
ethernet/IP address denying all outgoing packets
and put a sniffer on
Quoted 1 line
it. What are the security implications of this?
Mind the IP that sniffer
Quoted 1 line
is running on is denying all outgoing traffic and
dropping all incoming
Quoted 1 line
traffic and providing no services at all. On the
other hand the machine
Quoted 1 line
is inside the firewall.... a compromise here would
provide direct access
Quoted 1 line
to all local network resources. Is a compromise
Quoted 19 lines
possible on an IP that
Quoted 1 line
denies all traffic inbound and outbound? Should I
waste one machine for
Quoted 1 line
this task on my proposed small network (less than
20 machines)?
Quoted 3 lines
With thanks in advance ;-))
Sanjay.Signature · 7 lines
Stephen Samuel +1(604)876-0426 [email protected] http://www.bcgreen.com/~samuel/ Powerful committed communication. Transformation touching the jewel within each person and bring it to life.
__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com
Quoted 6 lines · Sanjay Arora
Netmask is 255.255.255.0 on all machines.
Point is that the WinXP machine is being given a
redirect by the Linux firewall and that is being
ignored, either due to inability of WinXP or some
misconfiguration by me.
[old stuff deleted]
As I said in my prior response, redirects are commonly (though not always) ignored. Redirects are a way of spoofing, thus a security hole (even though they also have legitimate uses, as in your case). That XP rejects redirect instructions is quite reasonable.
(Are you sure that your Linux client on the LAN is receiving and acting on the router's redirect message? You haven't said. In any case, if it is on network 192.169.250.0/24, and has default gateway 192.168.200.1, as your earlier message seemed to say, it has a more elaborate routing table than the WinXP host ... either a route to 192.168.200.0/24 or a static route to 192.168.200.1/32.)
In any case, if this is the "point" of your query, is it not better made on a Windows XP list than a pair of Linux lists? (BTW, no one else has mentioned this, but cross-posting of this sort is usually considered discourteous.) Both Linux hosts on the LAN seem to be functioning correctly (at least as far as I can tell from your description).
The only solution I can suggest is not to use the redirect trick to enable connectivity. Instead, give the WinXP host a proper routing table that tells it that it has a direct route to network 192.168.250.0/24.
-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs
Hello,
maybe you could try to turn off send_redirects??
echo "0" >/proc/sys/net/ipv4/conf/all/send_redirects echo "0" >/proc/sys/net/ipv4/conf/eth0/send_redirects
Maybe you'll have to write eth0 instead of eth0, depending on the interface for the internal network.
Hope this helps
Sven
Quoted 27 lines · Sanjay Arora
Netmask is 255.255.255.0 on all machines.
Point is that the WinXP machine is being given a
redirect by the Linux firewall and that is being
ignored, either due to inability of WinXP or some
misconfiguration by me.Sanjay.
Quoted 14 lines · --- Stephen Samuel
What are the netmasks for the two machines?? If you give them a /18
(or a /16) netmask and the associated broadcast addresses, then they'll
know to just talk directly to each other.Of course, I barely trust Windows to understand netmasks, but it
should be OK -- far better than trying to get it to accept ICMP
redirects.
Quoted 9 lines · Sven Schuster
Hello,
maybe you could try to turn off
send_redirects??echo "0" >/proc/sys/net/ipv4/conf/all/send_redirects echo "0" >/proc/sys/net/ipv4/conf/eth0/send_redirects
Maybe you'll have to write eth0 instead of eth0, depending on
Ouch...sorry, of course I mean eth1 or eth2 or what interface your internal network is running on ;-)
Quoted 7 lines
the interface for the internal network.
Hope this helps
Sven
AFAIK, Windows XP doesn't accept ICMP redirects.
I know that Windows 2000 and NT didn't, so it wouldn't surprise me if XP didn't. It's not secure... <g>.
Cheers,
Liam
Quoted 11 lines · Sanjay Arora
Netmask is 255.255.255.0 on all machines.
Point is that the WinXP machine is being given a
redirect by the Linux firewall and that is being
ignored, either due to inability of WinXP or some
misconfiguration by me.Sanjay.