Network Update...Need advice

[dpshak]

As the subject says, I've upgraded my network.

We are in the process of dropping DishNetwork in favor of Comcast with a Tivo box. I'm also going to build a media server to work in conjunction with the Tivo. Because all of my hardwired boxes are capable of 10/100/1000 networking and all of my wireless devices are 802.11n capable, I decided to replace my old Linksys WRT54G router with a NetGear WNR3500L to take advantage of the higher network speeds for media transfer. I also have an old, unused, P4 box with a couple of small hard drives that I thought I would turn into a firewall box with local rsync server and ntp server, etc.

This works, after a fashion, but NOT quite how I intended! (That seems to be the way these things always work for me... )

This is the way it looks: Cable Modem(WAN) -> Firewall_In(eth0) -> Firewall_Out(eth1) -> WNR3500L -> LAN (both wired and wireless)

DHCP, through the cable modem, provides the Public IP address to Firewall_In. Firewall_Out has a fixed (192.168.1.2) address. The router has a fixed (192.168.1.3) address. Finally, I use the router to assign addresses to the various devices based on their MAC address - 192.168.1.1##. Everything on the LAN can talk amongst themselves, and they can all access the internet. What they CANNOT do, is see the firewall box!

This is where I run into the proverbial wall. I don't know where to start to fix this! At the time I was putting all this together, it seemed like the perfect solution. A firewall box right at the 'fence' to protect the whole local network, a router that provided both wired and wireless networking, and oh by the way, let's put that 'left-over' hardware in the firewall box to use by hosting a local rsync server. This way, certain devices on the LAN can be blocked from any WAN access because anything they need is available on the LAN.

So the question is: Can I make this work? (If so, how?) or am I out of luck?

[DawgG]

probably a firewall-rule on Firewall:eth1, often a default DROP policy is set. check it with

[Hu]

Please post the output of iptables-save -c as seen by the firewall box.

[dpshak]

I THINK DawgG, you may have something here... I just have to wait until the rest of the LAN users go to bed to fix and restart the LAN... Apparently, I copied the info from Gentoo Router too closely and failed to allow for MY LAN addresses...

HU: this is the result...laboriously hand copied from that machine...

[Hu]

Your network rules need work, but nothing in there explains the symptoms that prompted you to post the thread.

[dpshak]

HU: Thanks again for taking the time!

Like a number of other folks, iptables gives me fits!
My goal, in using that link referenced above, was to get the system up and running. Once everything was running the way I wanted, I planned on installing Shorewall and using it to write proper network rules.

As I said in the original post, one of the things I wanted to do was to create a local rsync server on the firewall box. To test the connection:

[Hu]

[dpshak]

You are correct, in that I have the the WNR3500L AFTER the Firewall_Out and is acting as a router. It's running the TomatoUSB firmware instead of the OEM firmware. Other than assigning IP addresses to MAC addresses and configuring some WiFi settings, I haven't messed with any bridging, or iptables or the like.

ip route from the WNR3500L:

[Hu]

That is one of the odder network configurations I have seen. You may not have configured bridging, but someone or something did.

You have a redundant route which is wrong (#3), but it is shadowed by one which is right (#2). You have the P4 assigned an address that makes it appear to be on the same side of the router as the other machines, but it is not. There are some other aspects that are not wrong, but probably not what you really want. The simple way to keep the P4 in service would be to change the addressing so that its internal interface is on a separate subnet from the LAN-side devices. Your vlan configuration seems to indicate that you are using a single switch to connect both the LAN devices to the Netgear and the Netgear to the P4. The earlier ping failures suggest that this has not breached isolation, but it looks strange.

[dpshak]

I ran across a post, somewhere, where Shibby (the author of the firmware in the Netgear) talked about bridging in that router... unfortunately I haven't been able to find it again.

I think, in the interests of efficiency, I'm going to pull the P4 out of the lineup for now. When I have the time to learn more about networking in general, routing, bridging, vlans, etc. (and iptables) I may add it back in.

I DO appreciate your time and efforts HU! THANKS!

[BobWya]

[dpshak]

Thanks for the info BobWya!

As I told Hu above, I REALLY don't have enough ports in the Netgear router! (Piss, poor planning on my part!)
I'm planning on investing in a switch in the next week or so. Once I have that on hand, I'm going to (try to) use the P4 box as a router to feed the Switch and connect the hardwired PC's to the switch, along with the Netgear (for WiFi access) and see how that works.

From what I've seen of Hu, across this forum, he KNOWS HIS STUFF! If he says Shorewall isn't the way to go, I guess I'll have to buckle down and figure out how to do iptables (or its replacement) manually!

[Hu]

Shorewall may produce a functional configuration. My chief complaint with it is that, like with many machine-generated outputs, the output is messy and often suboptimal. Feel free to use Shorewall to create a first firewall if you need something working quickly. Just be aware that if you ever want to do something not supported by the Shorewall frontend, which includes getting iptables help from people who do not know Shorewall, you may end up doing a lot of duplicate work.

[BobWya]