You are not logged in.
Pages: 1
I'm about to move house, and so will be without an ADSL line while we wait for it to get set up. I've got a 3G USB modem, and would like to be able to share this connection with a second computer, but am not sure of exactly how to do it, and have found various conflicting answers in various places(especially regarding iptables). I'd also like to make sure I fully understand what I'm doing, so I can change things back again (or maybe put it in a script so it's easy to switch back and forth).
The setup at the moment is:
Arch Linux
192.168.1.33
(Running dnsmasq
as nameserver Windows
and squid locally) 192.168.1.34
\ /
\ /
\ /
\ /
\ /
\ /
ADSL router
192.168.1.1
(issuing reserved
IPs by DHCP,
and DNS server)
|
|
|
InternetThe two options I can see for sharing the 3G modem, using dnsmasq and squid for both Arch and Windows to speed up the laggy connection a bit, are:
(A)
Arch Linux Windows
Internet-----3G modem (PPP)----192.168.1.33 192.168.1.34
(Running dnsmasq (Pointed to dnsmasq and
and squid) squid on Arch box)
\ /
\ /
\ /
\ /
\ /
\ /
ADSL router
192.168.1.1
(issuing reserved
IPs by DHCP)
(B)
Internet-----3G modem-----Arch Linux-----(Ad-hoc connection)-----Windows
(dnsmasq/squid) (pointed at dnsmasq/squid)As the 3G modem is automatically handled without problem by networkmanager, and I'd like the setup to 'just work' when somebody else switches on the Arch box, it seems to me that the first option is the more straightforward. Does this sound right? If so, am I right in thinking the necessary steps are:
- Enable dnsmasq to receive connections locally (just add "listen-address=192.168.1.33" to /etc/dnsmasq.conf?)
- Modify squid.conf (add "acl ip_acl src 192.168.1.34" and "http_access allow ip_acl" at the relevant points?)
- Edit /etc/hosts.allow?
- Change Windows to default gateway=192.168.1.33, nameserver=192.168.1.33
- Edit iptables - how? My current rules are:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
MOBLOCK_IN all -- anywhere anywhere state NEW
DROP all -- 127.0.0.0/8 anywhere
DROP all -- 127.0.0.0/8 anywhere
DROP icmp -- anywhere anywhere icmp address-mask-reply
DROP icmp -- anywhere anywhere icmp address-mask-request
DROP icmp -- anywhere anywhere icmp router-solicitation
DROP icmp -- anywhere anywhere icmp router-advertisement
DROP icmp -- anywhere anywhere icmp redirect
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
interfaces all -- anywhere anywhere
open all -- anywhere anywhere
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP all -f anywhere anywhere
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP icmp -- anywhere anywhere icmp echo-request
Chain FORWARD (policy DROP)
target prot opt source destination
MOBLOCK_FW all -- anywhere anywhere state NEW
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
MOBLOCK_OUT all -- anywhere anywhere state NEW
Chain MOBLOCK_FW (1 references)
target prot opt source destination
NFQUEUE all -- anywhere anywhere NFQUEUE num 0
Chain MOBLOCK_IN (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere source IP range 192.168.1.33-192.168.1.255
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT udp -- anywhere anywhere udp dpt:microsoft-ds
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns
ACCEPT tcp -- anywhere anywhere tcp dpt:23399
ACCEPT tcp -- anywhere anywhere tcp dpt:952
ACCEPT tcp -- anywhere anywhere tcp dpt:951
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:microsoft-ds
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns
ACCEPT tcp -- anywhere anywhere tcp dpt:www
NFQUEUE all -- anywhere anywhere NFQUEUE num 0
Chain MOBLOCK_OUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere destination IP range 192.168.1.33-192.168.1.255
ACCEPT tcp -- anywhere anywhere tcp dpt:23399
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:ssmtp
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:www
NFQUEUE all -- anywhere anywhere NFQUEUE num 0
Chain interfaces (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain open (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:951 state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:952 state NEW,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp dpts:49888:49898
ACCEPT tcp -- anywhere anywhere tcp dpts:49888:49898
ACCEPT udp -- anywhere anywhere udp dpt:6881
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp dpt:microsoft-ds
ACCEPT tcp -- anywhere anywhere tcp dpt:microsoft-ds
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT udp -- anywhere anywhere udp dpt:mdns
ACCEPT tcp -- anywhere anywhere tcp dpt:www state NEW,ESTABLISHED
ACCEPT udp -- 192.168.1.1 anywhere udp dpt:syslogThanks for putting up with a rather extended post, and apologies if any of the answers seem a bit obvious - as I said, I've found conflicting answers to some of them while searching, and I'd like to make sure I do it right first time, to prevent an unreliable internet connection from adding to the house-moving stress!
P.S. If there's any additional advice on improving the iptables setup in general, it'd be more than welcome - what's there at present is a combination of following advice in the wiki, and inexpert knowledge on my part...
Offline
Pages: 1