Router with dual port lan.

verb0ss · 2012-06-18 22:49:25

Hello. I'm having hard time trying to setup a small router. The whole
point of me doing this is to learn more.
Here is brief idea of what I'm trying to achieve.

#-----------------------------------------------------------------------------------------------------------#

         DSL_router|<--------->|ARCH                  |    +------->Gentoo/windows
 gatway 192.168.0.1|           |static_ip 192.168.0.50|    |
                               |+dual_port_nic        |<---+ 
                                                           |
                                                           +-------->Network_printer

#-----------------------------------------------------------------------------------------------------------#

Since the home DSL router is setup in class C I decide to setup my
internal network in class A
So my Arch is connected to DSL router with static IP 192.168.0.50 on
eth0 and both eth1 has IP address 10.0.0.1 and eth2 10.0.0.2 (I want
those NICs to be in the same subnet. How?).
I'm not that concerned about setting up printer on eth2 at the moment.
The most important thing for me is to setup my main desktop computer
on eth1. So i followed Arch router wiki
https://wiki.archlinux.org/index.php/Router changing
interface names accordingly all the way down to "Connection sharing"

where i picked iptables instead of shorewall (just to learn more).
Then i followed this wiki ;
https://wiki.archlinux.org/index.php/Si … l_firewall.
And here is my first question:
Should I add

iptables -A INPUT -i eth1 -j ACCEPT

to my iptables?
Gentoo is set to have static IP 10.0.0.3 and it connects but i can't
ping 10.0.0.1. However i can ping 10.0.0.3 from Arch box so there must
be something wrong with iptables.

/etc/network.d/eth0-profile
CONNECTION='ethernet'
DESCRIPTION='Public Interface.'
INTERFACE='eth0'
IP='static'
ADDR='192.168.0.50'
GATEWAY='192.168.0.1'
NETMASK='255.255.255.0'
BROADCAST='192.168.0.255'

/etc/network.d/eth1-profile
CONNECTION='ethernet'
DESCRIPTION='Private Interface.'
INTERFACE='eth1'
IP='static'
ADDR='10.0.0.1'
NETMASK='255.255.255.0'
BROADCAST='10.0.0.255'

/etc/network.d/eth2-profile
CONNECTION='ethernet'
DESCRIPTION='Private Interface.'
INTERFACE='eth1'
IP='static'
ADDR='10.0.0.2'
NETMASK='255.255.255.0'
BROADCAST='10.0.0.255'

rc.conf
#
# /etc/rc.conf - Main Configuration for Arch Linux
#
# See 'man 5 rc.conf' for more details
#

# LOCALIZATION
# ------------
HARDWARECLOCK="UTC"
TIMEZONE="Europe/London"
KEYMAP="uk"
CONSOLEFONT=
CONSOLEMAP=
LOCALE=
DAEMON_LOCALE="yes"
USECOLOR="yes"

# HARDWARE
# --------
MODULES=()
USEDMRAID="no"
USEBTRFS="no"
USELVM="no"

# NETWORKING
# ----------
HOSTNAME=xxxxxxxxx

# DAEMONS
# -------
#
DAEMONS=(dbus syslog-ng iptables net-profiles dnsmasq crond alsa)

/etc/dnsmasq.conf
interface=eth1    # make dnsmasq listen for requests only on intern1 (our LAN)
expand-hosts      # add a domain to simple hostnames in /etc/hosts
domain=foo.bar    # allow fully qualified domain names for DHCP hosts
(needed when
                # "expand-hosts" is used)
dhcp-range=10.0.0.2,10.0.0.255,255.255.255.0,1h
                # defines a DHCP-range for the LAN:
                # from 10.0.0.2 to .255 with a subnet mask of
255.255.255.0 and a
                # DHCP lease of 1 hour (change to your own preferences)

more /etc/iptables/iptables.rules
# Generated by iptables-save v1.4.13 on Mon Jun 18 21:19:57 2012
*nat
:PREROUTING ACCEPT [682:81948]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [193:12198]
:POSTROUTING ACCEPT [193:12198]
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Jun 18 21:19:57 2012
# Generated by iptables-save v1.4.13 on Mon Jun 18 21:19:57 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1624:250741]
:TCP - [0:0]
:UDP - [0:0]
:fw-interfaces - [0:0]
:fw-open - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NE
W -j TCP
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j fw-interfaces
-A FORWARD -j fw-open
-A FORWARD -j REJECT --reject-with icmp-host-unreachable
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
-A UDP -p udp -m udp --dport 53 -j ACCEPT
-A fw-interfaces -i eth1 -j ACCEPT
COMMIT

If i did this:

# echo 1 >/proc/sys/net/ipv4/ip_forward

Do i still have to edit /etc/sysctl.conf as it says here?

more /etc/conf.d/iptables
# Configuration for iptables rules
IPTABLES_CONF=/etc/iptables/iptables.rules
IP6TABLES_CONF=/etc/iptables/ip6tables.rules

# Enable IP forwarding (both IPv4 and IPv6)
# NOTE: this is not the recommended way to do this, and is supported only for
# backward compatibility. Instead, use /etc/sysctl.conf and set the following
# options:
# * net.ipv4.ip_forward=1
# * net.ipv6.conf.default.forwarding=1
# * net.ipv6.conf.all.forwarding=1
#IPTABLES_FORWARD=0

And Gentoo network conf:

/etc/conf.d/net
config_eth0="10.0.0.3 netmask 255.255.255.0"
routes_eth0="default via 10.0.0.1"

Last edited by verb0ss (2012-06-18 23:13:18)

Gcool · 2012-06-18 23:36:49

In your current iptables setup, you're simply not allowing icmp (ping) traffic. Adding a new rule with "-A INPUT -p icmp" (potentially specify a source if you like) should solve that.

Setting "echo 1 >/proc/sys/net/ipv4/ip_forward" will only last until you reboot the system. In order to have it enabled on each boot, you would want to add that to your sysctl.conf.

fukawi2 · 2012-06-18 23:36:56

verb0ss wrote:

Since the home DSL router is setup in class C I decide to setup my
internal network in class A

Classful network addressing has been redundant for a long time; CIDR is what the hip kids use.

verb0ss wrote:

So my Arch is connected to DSL router with static IP 192.168.0.50 on
eth0 and both eth1 has IP address 10.0.0.1 and eth2 10.0.0.2 (I want
those NICs to be in the same subnet. How?).

Bridging, this link looks to detail what you are trying to achieve: http://www.sjdjweis.com/linux/bridging/

verb0ss wrote:

Should I add
iptables -A INPUT -i eth1 -j ACCEPT
to my iptables?

No, you need to setup bridging first, then you will be working with "br0" in iptables (not eth1/eth2)

Arch Linux

#1 2012-06-18 22:49:25

Router with dual port lan.

#2 2012-06-18 23:36:49

Re: Router with dual port lan.

#3 2012-06-18 23:36:56

Re: Router with dual port lan.

Board footer