IPTABLES: ip forwarding/masquerading problems

pobudz · 2005-08-16 08:17:50

my current rules (for testing purposes) are:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

with ip_forwarding enabled (echo 1 > /proc/sys/net/ipv4/ip_forward)

eth0 is 121.212.12.16/28 IP: 121.212.12.30
eth1 is 192.168.2.0/24 IP: 192.168.2.148

eth0 is the internal network
eth1 goes out to the external network

i cannot for the life of me get any packets to forward. I have iptables.rules saved in /etc/iptables/iptables.rules, and have run /etc/rc.d/iptables restart everytime I update my rules.

I have no idea where to go from here. I can access each network individually from each interface, but i can not get the two interfaces to see each other.

cactus · 2005-08-16 14:36:54

make sure you have "net.ipv4.ip_forward=1" in /etc/sysctl.conf too.

pobudz · 2005-08-17 06:19:58

yea thats already there too, im freaking clueless as to why im having so much trouble with this.

cactus · 2005-08-17 06:53:56

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT  
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Your forward rules had no destinations specified.
Give that a whirl

in your statement, you said that eth0 was the internal network, but you list an external routable ip for eth0, and an internal ip for eth1. I went based off the ip information, with eth0 being the external network, and eth1 being your internal (masqueraded) network.

if the masquerade target is not working for some reason, you could try the SNAT target...
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.2.148

Also, make sure your clients behind eth1 know that the gateway is 192.168.2.148 then, as some clients assume that a gateway for a given network is the first available address..in this case it would be 192.168.2.1

pobudz · 2005-08-30 15:52:59

our teacher had us create our own subnet (happened to be class a) behind a class C school network. thats why the IPs are offset a bit

Arch Linux

#1 2005-08-16 08:17:50

IPTABLES: ip forwarding/masquerading problems

#2 2005-08-16 14:36:54

Re: IPTABLES: ip forwarding/masquerading problems

#3 2005-08-17 06:19:58

Re: IPTABLES: ip forwarding/masquerading problems

#4 2005-08-17 06:53:56

Re: IPTABLES: ip forwarding/masquerading problems

#5 2005-08-30 15:52:59

Re: IPTABLES: ip forwarding/masquerading problems

Board footer