SNMP through VPN?
Hi list,
I have an issue, and I think it's because of my linited knowledge of iptables. The scenario:
linuxbox1---router1=====(IPSecTunnel)=====router2---linuxbox2 192.168.x.0/24============================10.a.b.0/24
I want to set up monitoring using SNMP. I *can* do this from linuxbox1 to linuxbox2 and vice versa, but not from linuxbox1 to router2 (internal interface) or from linuxbox2 to router1 (internal interface). All other services like ICMP or TCP (ssh) work in both directions, as do SNMP requests from the internal side to the internal interfaces of the routers.
In the firewall rules of router1, I added:
iptables -I forwarding_rule -p all -s 10.a.b.0/24 -d 192.168.x.0/24 -j ACCEPT
iptables -I forwarding_rule -p all -s 192.168.x.0/24 -d 10.a.b.0/24 -j ACCEPT
to allow all traffic in both directions. I tried the same with input and output and as the interface ipsec+, but still no luck. I can SNMP-query devices *behind* the routers, but not the routers themselves.
What am I doing wrong?
kind regards,
wjl aka Wolfgang Lonien
www.lonien.de
Signature · 3 lines
Key ID 0x728D9BD0 - public key available at wwwkeys.de.pgp.net '94 Honda NTV still running on fuel - everything else here proudly runs Debian GNU/Linux
Quoted 1 line · Wolfgang Lonien
Hi list,
<snip>
Quoted 1 line
What am I doing wrong?
Can you make other connections, not related to SNMP, from linuxbox1 to router2 and from linuxbox2 to router1, both to the router's internal interfaces?
And what packet sniffing software do you have available on the routers, so you can what's happening to the traffic.
Signature · 2 lines
deviants are sacrificed to increase group solidarity Jenny Solzer
Quoted 3 lines · Nick Drage
Can you make other connections, not related to SNMP, from linuxbox1 to router2 and from linuxbox2 to router1, both to the router's internal interfaces?
Yup - ssh and/or http work just like a charm...
Quoted 2 lines
And what packet sniffing software do you have available on the routers, so you can what's happening to the traffic.
I installed tcpdump lately. But it seems that some guy of the german Astaro support worked that out already - because that's our commercial firewall in the company, where I had the same effect.
Looks like some SNAT-rule together with another iptables 'ACCEPT' is necessary to get things going. As soon as I can confirm that the other way (from the company to the internal interface of my WRT54G), I'll keep you updated...
But thanks anyway,
cheers,
wjl
Signature · 3 lines
Key ID 0x728D9BD0 - public key available at wwwkeys.de.pgp.net '94 Honda NTV still running on fuel - everything else here proudly runs Debian GNU/Linux