[SOLVED]Arch as router

n1x4 · 2012-07-13 17:45:03

**EDIT: I must add, these issues are on the LAN pc not the router/arch box.. It works just fine! No errors, i can d/l, update, ping, etc **

Sup guys... I decided to use an old box as another router within my own network.. I've followed the wiki to the T and also searched and searched to no avail for a few days, so I come to you for some help..lol I installed IPCop on a different HDD and this setup worked just fine but when I switched to my Arch HDD I can't get it to work. I can resolve hostnames with ping/nslookup/host but nothing after that. I can't even open up the web.. I'm just about sure it's a policy issue (99.99999999999999999%).. I can change a few things around and 1 of a few things happens.. 1, I get absolutely nothing [ping: unknown host].. 2, It resolves the DNS to an IP but hangs there or 3, It'll resolve but spits out "Destination Host Unreachable"... Like I said, it worked fine with IPCop but I really need to use this HDD as it's a server as well.. I can ssh, scp and ping the LAN I'm on as well, just nothing outside is allowed to come in it seems

I don't use a hub/switch though, I just made a cross-over cable from some old cat5 laying around.

Just a scrot of some things route -n, wicd, pings...

/etc/shorewall/policy

#
# Shorewall version 4.0 - Sample Policy File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-policy"
###############################################################################
#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST

loc		net		ACCEPT
net		all		DROP		info
$FW             net             ACCEPT
loc             $FW             ACCEPT
$FW             loc             ACCEPT
# THE FOLLOWING POLICY MUST BE LAST
all		all		REJECT		info

/etc/shorewall/rules

#
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
# Copyright (C) 2006,2007 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-rules"
######################################################################################################################################################################################
#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
#							PORT	PORT(S)		DEST		LIMIT		GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW

#       Don't allow connection pickup from the net
#
Invalid(DROP)	net		all		tcp
#
#	Accept DNS connections from the firewall to the network
#
DNS(ACCEPT)	$FW		net
#
#	Accept SSH connections from the local network for administration
#
SSH(ACCEPT)	loc		$FW
#
#	Allow Ping from the local network
#
Ping(ACCEPT)	loc		$FW
#
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
#

Ping(DROP)	net		$FW

ACCEPT		$FW		loc		icmp
ACCEPT		$FW		net		icmp
#

Anyways, here's the rules/policy configs.. If you need to see anything else just let me know.
Thanks

Last edited by n1x4 (2012-07-13 22:57:51)

nomorewindows · 2012-07-13 18:24:22

I don't use shorewall, I just use iptables, with a simple masquerade rule shown in the internet sharing wiki.
If you're using it for a router, you don't really need wicd.
You might also need to modify /etc/sysctl.conf or echo 1>/proc/sys/net/ipv4/ip_forward to allow tcp forwarding.

n1x4 · 2012-07-13 20:29:45

I tried that as well man.. With just iptables running, I can't even resolve any hostnames. And yes, I edited sysctl.conf..
I just use wicd to simply switch between wired and wireless atm... Once it get's set up I'll move another server in here and replace..

Still, just the same..

Last edited by n1x4 (2012-07-13 20:33:20)

n1x4 · 2012-07-13 22:57:29

SOLVED......
I had the WRONG interface in /etc/shorewall/masq....

Arch Linux

#1 2012-07-13 17:45:03

[SOLVED]Arch as router

#2 2012-07-13 18:24:22

Re: [SOLVED]Arch as router

#3 2012-07-13 20:29:45

Re: [SOLVED]Arch as router

#4 2012-07-13 22:57:29

Re: [SOLVED]Arch as router

Board footer