andt wrote:
> Hej ng jeg er ved at sætte min server op. og den skal dele internet ud
> til mine klienter maskiner en xp og 2 gentoo "linux" og serveren køre
> også gentoo. Så har jeg fået instaleret DHCP server på den & det køre
> også, fint og mine klienter får også en ip adresse.
>
> Men får at de kan få adgang til internettet skal jeg have en firewall
> som kan roghte dem ud af huset. men det funger ikke helt for mig.
Den lette måde kunne være at bruge guidedog:
>
http://www.gnuskole.dk/router/index.html
Hilsen Claus
> jeg har 2 netkort i den eth0 er til internetet & eth1 er der hvor dhcp
> køre ind mod huset:
>
> her er hvad jeg har gjordt:
>
> # ifconfig -a
>
>
>>eth0 Link encap:Ethernet HWaddr 00:07:E9:0A:14:1C
>> inet addr:192.168.78.68 Bcast:192.168.78.255 Mask:255.255.255.0
>> UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
>> RX packets:68 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:43 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:1000
>> RX bytes:10051 (9.8 Kb) TX bytes:6048 (5.9 Kb)
>> Base address:0xb800 Memory:e5800000-e5820000
>>
>>eth1 Link encap:Ethernet HWaddr 00:03:CE:38:8D:ED
>> inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
>> UP BROADCAST MULTICAST MTU:1500 Metric:1
>> RX packets:0 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:1000
>> RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
>> Interrupt:18 Base address:0xe000
>>
>>lo Link encap:Local Loopback
>> inet addr:127.0.0.1 Mask:255.0.0.0
>> UP LOOPBACK RUNNING MTU:16436 Metric:1
>> RX packets:0 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:0
>> RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
>
>
> Da jeg kan se at det er oppe instaleret jeg iptables
>
>
>># emerge net-firewall/iptables
>
>
> og da det er instaleret går jeg ind i filen /etc/init.d/iptables
> og retter den til med.
>
> # iptables -F; iptables -t nat -F; iptables -t mangle -F
> # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> # echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
> # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> # iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
> # iptables -A INPUT -p icmp -j ACCEPT
> # iptables -I FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
>
>
>>#!/sbin/runscript
>># Copyright 1999-2005 Gentoo Foundation
>># Distributed under the terms of the GNU General Public License v2
>># $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.3.2.init,v 1.2 2005/08/10 23:11:12 vapier Exp $
>>#IPTABLES=/sbin/iptables
>>
>>opts="save reload panic"
>>
>>iptables_name=${SVCNAME}
>>if [[ ${iptables_name} != "iptables" && ${iptables_name} != "ip6tables" ]] ; then
>> iptables_name="iptables"
>>fi
>>
>>iptables_bin="/sbin/${iptables_name}"
>>case ${iptables_name} in
>> iptables) iptables_proc="/proc/net/ip_tables_names"
>> iptables_save=${IPTABLES_SAVE};;
>> ip6tables) iptables_proc="/proc/net/ip6_tables_names"
>> iptables_save=${IP6TABLES_SAVE};;
>>esac
>>
>>depend() {
>> before net
>> use logger
>>}
>>
>>set_table_policy() {
>> local chains table=$1 policy=$2
>> case ${table} in
>> nat) chains="PREROUTING POSTROUTING OUTPUT";;
>> mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
>> filter) chains="INPUT FORWARD OUTPUT";;
>> *) chains="";;
>> esac
>> local chain
>> for chain in ${chains} ; do
>> ${iptables_bin} -t ${table} -P ${chain} ${policy}
>> done
>>}
>>
>>checkkernel() {
>> if [[ ! -e ${iptables_proc} ]] ; then
>> eerror "Your kernel lacks ${iptables_name} support, please load"
>> eerror "appropriate modules and try again."
>> return 1
>> fi
>> return 0
>>}
>>checkconfig() {
>> if [[ ! -f ${iptables_save} ]] ; then
>> eerror "Not starting ${iptables_name}. First create some rules then run:"
>> eerror "/etc/init.d/${iptables_name} save"
>> return 1
>> fi
>> return 0
>>}
>>
>>start() {
>>/sbin/iptables -F; iptables -t nat -F; iptables -t mangle -F
>>/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
>>echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
>>/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>/sbin/iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
>>/sbin/iptables -A INPUT -p icmp -j ACCEPT
>>
>> checkconfig || return 1
>> ebegin "Loading ${iptables_name} state and starting firewall"
>> ${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
>> eend $?
>>
>>}
>>
>>stop() {
>> if [[ ${SAVE_ON_STOP} == "yes" ]] ; then
>> save || return 1
>> fi
>> checkkernel || return 1
>> ebegin "Stopping firewall"
>> for a in $(<${iptables_proc}) ; do
>> ${iptables_bin} -F -t $a
>> ${iptables_bin} -X -t $a
>>
>> set_table_policy $a ACCEPT
>> done
>> eend $?
>>}
>>
>>reload() {
>> checkkernel || return 1
>> ebegin "Flushing firewall"
>> for a in $(<${iptables_proc}) ; do
>> ${iptables_bin} -F -t $a
>> ${iptables_bin} -X -t $a
>> done
>> eend $?
>>
>> start
>>}
>>
>>save() {
>> ebegin "Saving ${iptables_name} state"
>> touch "${iptables_save}"
>> chmod 0600 "${iptables_save}"
>> ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
>> eend $?
>>}
>>
>>panic() {
>> checkkernel || return 1
>> [[ -e ${svcdir}/started/${iptables_name} ]] && svc_stop
>>
>> ebegin "Dropping all packets"
>> for a in $(<${iptables_proc}) ; do
>> ${iptables_bin} -F -t $a
>> ${iptables_bin} -X -t $a
>>
>> set_table_policy $a DROP
>> done
>> eend $?
>>}
>
>
>
> derefter køre jeg
> # iptables-save > /etc/iptables.conf
>
> & åbner filen /etc/conf.d/local.start
> og retter den til
>
>># /etc/conf.d/local.start
>>
>># This is a good place to load any misc programs
>># on startup ( use 1>&2 to hide output)
>>echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
>>iptables-restore < /etc/iptables.conf
>
>
> så åbner jeg filen /etc/conf.d/iptables
> og retter den til
>
>># /etc/conf.d/iptables
>>
>># Location in which iptables initscript will save set rules on
>># service shutdown
>>IPTABLES_SAVE="/var/lib/iptables/rules-save"
>>
>># Options to pass to iptables-save and iptables-restore
>>SAVE_RESTORE_OPTIONS="-c"
>>
>># Save state on stopping iptables
>>SAVE_ON_STOP="yes"
>>
>># Change to "yes" to enable forwarding support in the kernel. Please
>># note that this will override any setting placed in /etc/sysctl.conf.
>>ENABLE_FORWARDING_IPv4="yes"
>
>
>
> så har jeg været ind og rette filen nano /etc/sysctl.conf til
>
>
>
>># /etc/sysctl.conf
>>#
>># For more information on how this file works, please see
>># the manpages sysctl(8) and sysctl.conf(5).
>>#
>># In order for this file to work properly, you must first
>># enable 'Sysctl support' in the kernel.
>>#
>># Look in /proc/sys/ for all the things you can setup.
>>#
>>
>># Disables packet forwarding
>>net.ipv4.ip_forward = 1
>># Disables IP dynaddr
>>#net.ipv4.ip_dynaddr = 0
>># Disable ECN
>>#net.ipv4.tcp_ecn = 0
>># Enables source route verification
>>net.ipv4.conf.default.rp_filter = 1
>># Enable reverse path
>>net.ipv4.conf.all.rp_filter = 1
>>
>># Disable source route
>>#net.ipv4.conf.all.accept_source_route = 0
>>#net.ipv4.conf.default.accept_source_route = 0
>>
>># Disable redirects
>>#net.ipv4.conf.all.accept_redirects = 0
>>#net.ipv4.conf.default.accept_redirects = 0
>>
>># Disable secure redirects
>>#net.ipv4.conf.all.secure_redirects = 0
>>#net.ipv4.conf.default.secure_redirects = 0
>>
>># Ignore ICMP broadcasts
>>#net.ipv4.icmp_echo_ignore_broadcasts = 1
>>
>># Disables the magic-sysrq key
>>#kernel.sysrq = 0
>># When the kernel panics, automatically reboot in 3 seconds
>>#kernel.panic = 3
>># Allow for more PIDs (cool factor!); may break some programs
>>#kernel.pid_max = 999999
>>
>># TCP Port for lock manager
>>#fs.nfs.nlm_tcpport = 0
>># UDP Port for lock manager
>>#fs.nfs.nlm_udpport = 0
>
>
>
> kan udmilbart ikke se at jeg har gjordt noget galt: er der nogle der kan
> komme med et hint til hvad jeg eventuel har gjordt forkert???