Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Need help with Gentoo router set-up
View unanswered posts
View posts from last 24 hours

Goto page Previous  1, 2, 3, 4  Next  
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Wed May 20, 2020 8:44 pm    Post subject: Reply with quote

NeddySeagoon wrote:

Now,
Code:
May 19 10:05:11 k6 kernel: fw-loc REJECT IN= OUT=lan0 SRC=192.168.0.106 DST=192.168.0.102 LEN=49 TOS=0x00 PREC=0x00 TTL=64 ID=50010 DF PROTO=UDP SPT=36933 DPT=53 LEN=29
Thats a DNS lookup. (UDP on port 53) so it should probably be going to the outside world, not loc.


192.168.0.102 Is another box running DNSMasq for DNS service and shortly DHCP. The router, 192.168.0.1 is currently doing DHCP and not badly. DNSMasq can do that function. I'm just finishing up a nice GUI application duplicating the functions. It just gathers the data, writes the appropriate lines into /etc/dnsmasq.conf, restarting DNSmasq. A web page would be nice but I have zero experience or training. I have a grandson who did webpages in school. He could probably use some cash with this COVID shutdown. It might be nicer to hire him rather than give him a gift.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Wed May 20, 2020 8:53 pm    Post subject: Reply with quote

pietinger wrote:
...

The High Priest philosophy. If I subscribed to that I would just run Windows and Windows Firewall. Possibly Ubuntu without apt-get

Shorewall is supposed to be simpler than iptables. I went down this road before but the forum participants said it was not secure.

At least shorewall is logging. I just wish I didn't have to walk up and down two flights of stairs to reboot the computer.
Perhaps I can figure out from NedySeagoon's examples how to punch a hole for ssh.

My timer script to shutdown and reboot isn't working.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 46322
Location: 56N 3W

PostPosted: Wed May 20, 2020 8:57 pm    Post subject: Reply with quote

Tony0945,

You have two problems here. One is getting to grips with shorewall.
The other is setting up routing the way you need it. The are different separate unrelated problems.

Keep it simple. Remove all the network cards from the box except one.
Get that on the internet without shorewall.

That will ensure that your routing is correct.

With routing fixed, when you start shorewall, you will have two zones, I would call them fw (thats fixed anyway) and net, short for internet.
Now you can play with the shorewall setup. There's not a lot you can do with only the two zones but you can dip a toe in the water.

Next up is to add another interface so you can adjust shorewall over ssh and use it as a router for the downstream ssh controller.
At this point, you want the Gentoo Home Router Guide but where it uses IPtables, you use shorewall.
You will use IPTables but not in the raw.

Its very easy shut down remote access, once you are using ssh.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Wed May 20, 2020 9:14 pm    Post subject: Reply with quote

Obvious why the script failed:
Code:
#! /bin/bash
sleep 1800
service shortwall stop && reboot

I need two new eyes and two new hands.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Wed May 20, 2020 9:42 pm    Post subject: Reply with quote

Tony0945 wrote:
At least shorewall is logging

No ! It doesnt log. The kernel is doing it ... because of a directive from an iptables command like: iptables -A INPUT -j LOG --log-prefix "Explanation Text"
So shorewall just translate something in native iptables commands.

Tony0945 wrote:
Perhaps I can figure out from NedySeagoon's examples how to punch a hole for ssh.

If you would use a simple script, it would be only one simple line ...

Tony0945 wrote:
Shorewall is supposed to be simpler than iptables.

Yes, I see ...

Neddy told you one important thing: You must distinguish between networking and the firewall. First set up the network, like Neddy told you. Afterwords it is the first step to decide what you want. A pure Firewall with 2 Interfaces between a LAN and the world (internet) OR a firewall with 3 Interfaces; the 3rd one for a DMZ (or only one server) or a WLAN Network for you and guests. CHAINS do you really need only with 3 interfaces, with 2 interfaces it isnt really needed and confuses only. I am a big fan of KISS also, so I can write you a script (with explanations) for what you want to do.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 46322
Location: 56N 3W

PostPosted: Wed May 20, 2020 10:02 pm    Post subject: Reply with quote

Tony0945,

If you think of writing hex code to program a PC, that's akin to wiriting raw rules for IPtables.
One level up, you write assembler for your PC and shorewall for IPtables.

Shorewall assumes that if you add a rule to allow traffic out, you will also want a rule to allow the responses back in.
You might not, but lets ignore that for now, you get the allow responses rule without asking.

With IPTables, its two rules to write.

Both ways do the same thing.

Like pietinger says, shorewall generates lots of chains that do nothing.
It has a setting to optimise these away when the shorewall rules are converted to IPtables rules.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Wed May 20, 2020 10:44 pm    Post subject: Reply with quote

NeddySeagoon wrote:
If you think of writing hex code to program a PC, that's akin to wiriting raw rules for IPtables.
One level up, you write assembler for your PC and shorewall for IPtables.

Not quite ... iptables is like writing a simple "PRINT 'hello world'" in BASIC, and shorewall does the same in C++ with many Objects created ...
NeddySeagoon wrote:
With IPTables, its two rules to write.

I cant remember how long ago it is. Yes there was a time (I think until kernel 2.0) you had to explicitly allow an outgoing ping-request and the incoming ping-response (yes, I had to configure it, when I was young). And the same for every protocol or target host, or target net. But then we had a (great) upcoming with a new kernel (2.2 I believe): the STATEFUL inspection ! What does this mean ?

Every communication between two computers begins with sending out the FIRST packet to the target, e.g. saying "hello, its me, I want to talk with your web-server". The answer from this web-server and all other packets related to this session, must be allowed also in the firewall, because the kernel filters EVERY packet. With the new kernel you was able to allow all RELATED packets for this session automatically. So, TODAY, when we configure a firewall, we simply allow only the INITIATING of a session (or just the first packet when using a session-less protocol like UDP) and the kernel checks by itself what is a packet belonging to this. This is why you see in every Firewall-script at minimum always these two lines:
Code:
iptables -A INPUT       -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT      -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

and today you only allow the initiating of ssh or https or even a ICMP-ping ... without explicit allowing the responses / receive packets.
And because the kernel filters really every packet - even the internal communication on loopback - you must allow this also in every case with:
Code:
iptables -A INPUT       -i lo -j ACCEPT
iptables -A OUTPUT      -o lo -j ACCEPT

And because the most packets (99%) will be filtered (=allowed) by these rules, you should put these rules to the very beginning.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Thu May 21, 2020 2:37 pm    Post subject: Reply with quote

OK, I surrender. maybe I'm just too stupid like pietinger says. I can't understand why wheh I tell shorewall to allow all local traffic that ssh immediately stalls.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 46322
Location: 56N 3W

PostPosted: Thu May 21, 2020 5:50 pm    Post subject: Reply with quote

Tony0945,

You are trying to eat an elephant. That's best done one plateful at a time.

Divide your elephant up into manageable platefuls.
Be sure you digest one plateful before you start another.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Thu May 21, 2020 6:30 pm    Post subject: Reply with quote

Tony0945 wrote:
OK, I surrender. maybe I'm just [...] like pietinger says.

No, I didnt say this - and I didnt mean this !

With my first post I wanted to help you, recommending something I think it would be more simple (for me it is). If you would tell me (/us) what you want to do with your computers (what is your goal), I could help you with the network settings.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Fri May 22, 2020 12:51 am    Post subject: Reply with quote

pietinger wrote:
No, I didn't say this - and I didn't mean this !

I'm sorry. I guess I was overly touchy. I'm sorry I misinterpreted your remarks. Living in lockdown with nothing but COVID-19 news and nothing to do but bang my head on shorewall for days must be getting on my nerves.
What I'm trying to do is Gentoo as Home Router
The DHCP and DNS were easy. About halfway through with a wxGTK interface that looks like my ten year old DLink router. TheGUI part is done. What's left is reading, writing and text manipulation of the configuration files in C++. Duck soup.

The NAT and firewall functions are where I fell down. I've gone back to my iptables script from ten years ago. I abandoned that because of many remarks on the forum that my rules made no sense. But at least I'm not locked out of ssh!
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Fri May 22, 2020 1:07 am    Post subject: Reply with quote

This is the script from 2018 that works, but I know that I should start with DROPS and add ACCEPTS instead of the other way around. But there is a lot to accept.
Code:
#! /bin/bash

cp /etc/conf.d/net.router /etc/conf.d/net
cp /etc/dnsmasq.conf-router /etc/dnsmasq.conf

iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#lock services so they only work from the LAN
iptables -I INPUT 1 -i lan0 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -p UDP --dport bootps ! -i lan0 -j REJECT
iptables -A INPUT -p UDP --dport domain ! -i lan0  -j REJECT

#Drop TCP / UDP packets to privileged ports
iptables -A INPUT -p TCP ! -i lan0 -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p UDP ! -i lan0 -d 0/0 --dport 0:1023 -j DROP

#Finally add the rules for NAT
iptables -I FORWARD -i lan0 -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i lan0 -s 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i wan0 -d 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE

#Inform the kernel that IP forwarding is OK
echo 1 > /proc/sys/net/ipv4/ip_forward
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done

/etc/init.d/iptables save


And this script is running right now, but doesn't have NAT
Code:
#! /bin/bash

cp /etc/conf.d/net.pc /etc/conf.d/net
cp /etc/dnsmasq.conf-pc /etc/dnsmasq.conf

#Inform the kernel that IP forwarding is not OK
echo 0 > /proc/sys/net/ipv4/ip_forward
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 0 > $f ; done
#flush all, delete all user-defined and zero all counters
iptables -F
iptables -X
iptables -Z
iptables -t raw -F OUTPUT

#set default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  ACCEPT

# Now add rules
echo "everything local is OK"
iptables -A INPUT   -s 127.0.0.1 -j ACCEPT

#keep everything currently connected
#echo "keep everything currently connected"
iptables -A INPUT  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

echo "accept HTTP, HTTPS"
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

echo "SSH/SSL only from LAN"
iptables -A INPUT -p tcp --dport 22 -s 192.168.0.100/27 -j ACCEPT

#for netbios
echo "keep netbios broadcasts"
iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j ACCEPT

# NetBIOS Name Service (name resolution)
iptables -A INPUT -i eth0 -p udp --dport 137 -s 192.168.0.0/24 -j ACCEPT

# NetBIOS Datagram Service (BROWSER service)
iptables -A INPUT -i eth0 -p udp --dport 138 -s 192.168.0.0/24 -j ACCEPT

# NetBIOS Session Service (data transfer legacy SMB/NetBIOS/TCP)
iptables -A INPUT -i eth0 -p tcp --dport 139 -s 192.168.0.0/24 -j ACCEPT

# Microsoft Directory Service (data transfer SMB/TCP)
iptables -A INPUT -i eth0 -p tcp --dport 445 -s 192.168.0.0/24 -j ACCEPT

# All NetBIOS clients must have the netbios-ns helper enabled for broadcast name resolution to work
iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns

# NetBIOS Name Service (name resolution)
iptables -A INPUT -i eth0 -p udp --dport 137 -s 192.168.0.0/24 -j ACCEPT

# NetBIOS Datagram Service (BROWSER service)
iptables -A INPUT -i eth0 -p udp --dport 138 -s 192.168.0.0/24 -j ACCEPT

# NetBIOS Session Service (data transfer legacy SMB/NetBIOS/TCP)
iptables -A INPUT -i eth0 -p tcp --dport 139 -s 192.168.0.0/24 -j ACCEPT

# Microsoft Directory Service (data transfer SMB/TCP)
iptables -A INPUT -i eth0 -p tcp --dport 445 -s 192.168.0.0/24 -j ACCEPT

# All NetBIOS clients must have the netbios-ns helper enabled for broadcast name resolution to work
iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns

echo "stop malformed auth packets"
iptables -A INPUT -p tcp --syn --dport 113 -j REJECT --reject-with tcp-reset

echo "allow icmp"
iptables -A INPUT -p icmp  -j ACCEPT --log-level debug --log-prefix "IPT="

echo "allow pings"
iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT
echo "allow traceroute"
iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 12 -j ACCEPT

echo "allow DNS"
iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT

echo "everything can access DLNA"
iptables -A INPUT -p tcp  --dport 8200 -j ACCEPT
iptables -A INPUT -p udp  --dport 1900 -j ACCEPT

#that's it for the TV & Firestick
iptables -A INPUT -s 192.168.0.190 -j DROP
iptables -A INPUT -s 192.168.0.192 -j DROP
iptables -A INPUT -s 192.168.0.193 -j DROP

#permanent network computers can do anything
#permanent network computers can do anything

iptables -A INPUT -s 192.168.0.100 -j ACCEPT
iptables -A INPUT -s 192.168.0.101 -j ACCEPT
iptables -A INPUT -s 192.168.0.102 -j ACCEPT
iptables -A INPUT -s 192.168.0.104 -j ACCEPT
iptables -A INPUT -s 192.168.0.105 -j ACCEPT
iptables -A INPUT -s 192.168.0.106 -j ACCEPT
iptables -A INPUT -s 192.168.0.108 -j ACCEPT
#including the wireless computers
iptables -A INPUT -s 192.168.0.103 -j ACCEPT
iptables -A INPUT -s 192.168.0.109 -j ACCEPT
# and Maggi
iptables -A INPUT -s 192.168.0.170 -j ACCEPT

echo "accept  router multicast messages"
iptables -A INPUT -s 192.168.0.1  -d 224.0.0.1 -j ACCEPT
echo " and broadcast messages"
iptables -A INPUT -s 192.168.0.1  -d 255.255.255.255 -j ACCEPT

echo ignore uPNP requests except for TV
iptables -A INPUT -s 192.168.0.193 -d 239.255.255.250 -j ACCEPT
iptables -A INPUT -d 239.255.255.250 -j REJECT

echo "drop DHCP requests, we are not a router"
iptables -A INPUT -s 0.0.0.0 -d 255.255.255.255 -j REJECT

LOG_DROP=${LOG_DROP:=DROP:}
iptables -A FORWARD -p tcp -j LOG --log-level debug --log-prefix "IPT="

iptables  -N logdrop
iptables  -A logdrop -j LOG --log-prefix "${LOG_DROP}"
iptables  -A logdrop -j DROP
echo " This is the last rule in the chain, it logs and drops everything that got through the gauntlet"
iptables  -A INPUT -m conntrack --ctstate NEW -j logdrop
iptables -A INPUT -j DROP
/etc/init.d/iptables save

Logging isn't working.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Fri May 22, 2020 10:25 am    Post subject: Reply with quote

Tony0945 wrote:
I'm sorry. I guess I was overly touchy. I'm sorry I misinterpreted your remarks. Living in lockdown with nothing but COVID-19 news and nothing to do but bang my head on shorewall for days must be getting on my nerves.

Its okay, Tony - I am living in lockdown also ... :-(

I will help you, as good as I can (and with my poor school english). When I explain something you already know, then I do it only because for all readers of this post. First of all, I want to explain for what a firewall is good for. What it can do and what it cant do ?

A firewall has two sides:

1.) It can prevent you from the Internet, allowing only communications to a dedicate server you have.
2.) If you have a bad program (virus, rootkit) on your computer, it can TRY to disallow this bad program communicating with a bad server somewhere in the internet.

First look on (2). Why I wrote: "TRY" ? Because a firewall alone cant do this. Why ? The answer is: You want to go with your browser into the internet and read some webpages from "https://forums.gentoo.org". Therefore you must allow outgoing https-traffic (this is port: 443). Now you have a bad program, who wants to communicate with a bad server. This bad program communicate also over the same (open) port to its bad server ... and the firewall (must) allow this. What you would need, is a proxy server for websurfing, who log all communications into the internet for the port 443 (and 80 for normal http), so you dont go directly with your browser into the internet. Without a proxy server, the whole crap: "filtering outgoing packets" doesnt help you in any case against bad programs ... and therefore is complete senseless. Whithout a proxy you can simply allow ALL outgoing traffic and use the firewall only for (1).

In a workstation with 1 interface (e.g. ethernet) a packet can go 2 WAYS: From your computer to the net (outgoing), or from the net into your computer (ingoing).

On a router with 2 interfaces (e.g. one for LAN and one for WAN) you have 6 WAYS (with used iptables chains in brackets):
- From LAN to router (INPUT -i $LAN)
- From LAN to WAN (FORWARD -i $LAN)
- From router to LAN (OUTPUT -o $LAN)
- From router to WAN (OUTPUT -o $WAN)
- FROM WAN to router (INPUT -i $WAN)
- FROM WAN to LAN (FORWARD -i $WAN)

On a router with 3 interfaces (e.g. one for LAN, one for WAN and one for a DMZ) you have 12 WAYS (I dont want to explain now, maybe later).

Sidestep: There was a time (long long ago), a packet which should be routed, was put in first in INPUT, then in FORWARD and 3rd in OUTPUT. TODAY such a packet is put ONLY in the table "FORWARD".

So we look to a router with 2 interfaces. What do you want allow and what you want disallow ? First, we make it simple and say: We have no Server inside our LAN, AND the router itself should not talk with the internet AND the LAN - just be a passive thing. Only exception: I want to go with ssh from a workstation (inside my LAN) to the router. If we set the standard action to "DROP" for all tables, what we have to allow ? I would say:

- From LAN to router (INPUT -i $LAN) => SSH (and all packets belonging to an existing session)
- From LAN to WAN (FORWARD -i $LAN) => ALL
- From router to LAN (OUTPUT -o $LAN) => only packets belonging to an existing session (should be ssh answers only)
- From router to WAN (OUTPUT -o $WAN) => ... nothing (or maybe NTP for the time in the router)
- FROM WAN to router (INPUT -i $WAN) => ... nothing (or maybe only packets belonging to an existing session (if NTP))
- FROM WAN to LAN (FORWARD -i $WAN) => only packets belonging to an existing session

(BREAK: I must go away now. I will continue in some hours. Sorry. Please wait)
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Fri May 22, 2020 4:00 pm    Post subject: Reply with quote

[continue from above]


Before I go on, I want to explain WHY we use a script. This had two reasons - one is historical. So, today it is only because of one reason.

Perhaps you already know, what you do when you type in an iptables command: You configure your kernel at runtime, like you configure your kernel at runtime with the command "sysctl". But the kernel doesnt store these settings. After a reboot they are all gone. So you have to load them again when you startup your computer. All settings you want to set with sysctl is done from the init-script: "/etc/init.d/sysctl" (you know this already).

A) A long time ago we had no script for setting the filtering settings (with iptables) at startup. Therefore you had to do it by yourself. An old example of such a script you find here: https://wiki.gentoo.org/wiki/Security_Handbook/Firewalls
Please dont use it - its outdated (I would delete it, to not confuse people reading this page) ! Today we have our own script for saving and restoring the settings: "/etc/init.d/iptables". Use only this one !

B) So, today we use a script only for one reason: If you want to change or add some rules for an existant setting. Theoretical you can use "iptables -D ..." or "-I" or -R" to delete, insert or replace some lines of your rules, but nobody does this. It is too complicated. It is easier to delete all existing rules and send all (with the new rule(s)) again to the kernel. So we use only "iptables -A" (for append) in our script. And we run the script only one time and the do an initial "/etc/init.d/iptables save". (this script must be add to the runlevel "default" also). Or a second time, if you change something ...

-----

Back to our router: We configure the kernel for our simple example (and expand it later for your wishes). What we have to do ? First we delete all existing rules (1). We have no user-definied chaines, but we want to be absolut sure there is nothing left, so (2) doesnt harm. (at this point I recommend to take a look into the manpage of iptables). Then we set a default policy to every table (3). At this point you must know some important behavior of the kernel:

1. When the kernel receives a packet, it "put it in" one of 3 tables and then compares the packet with the first rule of THIS table.
2. When this compare was successful, the kernel "jumps" to a target. We have two build-in targets: DROP and ACCEPT. These targets are "end-station"-targets. The kernel doesnt proof any other rules after this. Another target is "LOG". This is NOT an end-station. The kernel just log something and proceed with the next rule.
4. When this compare was not successful, the kernel does nothing and proceed with the next rule.
3. If there is/was no "end-station-rule" for the specific packet, the kernel does what the default policy say.

Side-Note: Because of 1. it makes no difference if you define first all the rules for INPUT and then for OUTPUT or reverse. For performance reasons it is only important to think about the order of the rules WITHIN one table.

Next we think about which ways (of which protocols) would induce the most traffic ? This we set at first for performance reasons. We allow all traffic from LAN to WAN (4) and allow all packets "answering back" (5). Now we have two of our 6 lines allowed. The next is our ssh from LAN into the router (6) and back (7). Al last ( 8 ) we have to allow the internal communication of the loopback interface of the router (this you have to do always for every firewall-type, so it is usually at the beginning of every script you will find). Now we are finished.

Dont forget: (5) and (7) you define only one time. If you want allow, for example, additional "http" from LAN into the router, you need only allow this unidirectional, because "the way back" is handled from (7) again.
Code:
#!/bin/sh

# Defines

# please edit this with your real interface-names you will find with "ifconfig" (your names maybe begins with "enp....")
LAN=eth0
WAN=eth1

### (1)
iptables -F

### (2)
iptables -X

### (3)
iptables -P INPUT       DROP
iptables -P OUTPUT      DROP
iptables -P FORWARD     DROP

### (4)
iptables -A FORWARD     -i $LAN -j ACCEPT

### (5)
iptables -A FORWARD     -i $WAN -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### (6)
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j ACCEPT

### (7)
iptables -A OUTPUT      -o $LAN -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### (8)
iptables -A INPUT       -i lo -j ACCEPT
iptables -A OUTPUT      -o lo -j ACCEPT


Now we make one change: We allow our ntp-daemon in our router to communicate with a time-server from the internet. You have 3 options to do that:

a) You allow your router ONLY NTP-traffic out to ALL Servers in the internet, or
b) You allow your router ALL traffic out to ONE Time-Server in the internet, or
c) You allow your router ONLY NTP-traffic out to ONE Time-Server.

I must not say which is the most secure option (c), but if we trust our ntp-client AND we have more than ONE time-server we want to ask for the time, it is practically to allow (a) because this will be one rule and (c) would be a rule for every time-server we want to connect. I give you (c) as example (you could simply add to the script, but wait a little bit):
Code:
NTPSERVER="a.b.c.d"

iptables -A OUTPUT      -o $WAN -d $NTPSERVER -p udp --dport 123 -j ACCEPT
iptables -A INPUT       -i $WAN -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

You should be able now to change this, if you want solution (a) ... =>
Code:
iptables -A OUTPUT      -o $WAN -p udp --dport 123 -j ACCEPT
iptables -A INPUT       -i $WAN -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

In this two examples we did something which is not absolutely necessary: Differentiate between LAN and WAN in the "conntrack lines". Usually you have only 3 lines at the beginning of your script and then only your special allows. So, our next example has an other sequence.

Now we want to log something. You have 4 options for what you want to log:

a) Every connection from X to Y, or
b) One specific action, or
c) Some specific actions (but not too much), or
d) Almost every connection, except some specific actions

We can shorten this list, because for (b) and (c) we do the same. First we want to log every ssh-connection to our router. You see, the matching is identically, only the target is LOG instead of ACCEPT =>
Code:
#!/bin/sh
LAN=eth0
WAN=eth1
iptables -F
iptables -X
iptables -P INPUT       DROP
iptables -P OUTPUT      DROP
iptables -P FORWARD     DROP
iptables -A INPUT       -i lo -j ACCEPT
iptables -A OUTPUT      -o lo -j ACCEPT
iptables -A INPUT       -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT      -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD     -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD     -i $LAN -j ACCEPT

### this is the line we need AND it MUST be BEFORE the "end-station-accept":
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j LOG --log-prefix "ssh-connect from my LAN "

iptables -A INPUT       -i $LAN -p tcp --dport 22 -j ACCEPT

Now you want to log all connections going outside to the internet (e.g. only for troubleshooting):
Code:
#!/bin/sh
LAN=eth0
WAN=eth1
iptables -F
iptables -X
iptables -P INPUT       DROP
iptables -P OUTPUT      DROP
iptables -P FORWARD     DROP
iptables -A INPUT       -i lo -j ACCEPT
iptables -A OUTPUT      -o lo -j ACCEPT
iptables -A INPUT       -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT      -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD     -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j LOG --log-prefix "ssh-connect from my LAN "
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j ACCEPT

### this is the line we need AND it MUST be BEFORE the "end-station-accept":
iptables -A FORWARD     -i $LAN -j LOG --log-prefix "connect from my LAN to internet "
iptables -A FORWARD     -i $LAN -j ACCEPT

At last, the most difficult: You want to log every connection, except all http and https (web-surfing). This is a little bit trickier, because you have to allow first all, you dont want to log; then log all the rest, and then allowing all the rest =>
Code:
#!/bin/sh
LAN=eth0
WAN=eth1
iptables -F
iptables -X
iptables -P INPUT       DROP
iptables -P OUTPUT      DROP
iptables -P FORWARD     DROP
iptables -A INPUT       -i lo -j ACCEPT
iptables -A OUTPUT      -o lo -j ACCEPT
iptables -A INPUT       -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT      -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD     -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j LOG --log-prefix "ssh-connect from my LAN "
iptables -A INPUT       -i $LAN -p tcp --dport 22 -j ACCEPT

# Allow all outgoing http and https without logging:
iptables -A FORWARD     -i $LAN -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD     -i $LAN -p tcp --dport 443 -j ACCEPT

# Now we log the rest (with the same line from above)
iptables -A FORWARD     -i $LAN -j LOG --log-prefix "connect from my LAN to internet "

# and allow the rest (with the same line from above)
iptables -A FORWARD     -i $LAN -j ACCEPT


I recommend to work with "iptables -L -v -n" in combination with "iptables -Z" because you can see the count of packets for every rule (-Z set it to zero).

You can find an actual example of a script for a computer with ONE interface with filtering OUTGOING traffic (because I use a proxy) here: https://forums.gentoo.org/viewtopic-t-1112806-highlight-.html

If you have any specific question, please be free and ask me here.

Stay healthy and have a good time,
Peter
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Fri May 22, 2020 8:10 pm    Post subject: Reply with quote

pietinger, WOW! I read it all through, I think I understand every step, but will have to re-read several times. That was an excellent exposition and you should put it in the Gentoo Wiki.
That must have taken a lot of time to write. Thank you very much.

For reference, here is where the wan0, lan0 names come from. On my workstations I use mdev with a few extensions, but on this particular machine, I use an old version of eudev. I think it's the same one that anon-a-moose uses. Here is the custom eudev rule that assigns the names by MAC address.:
Code:
k6 ~ # cat /etc/udev/rules.d/ethernet.rules
## NOTES
# wan0  Realtek 8139too driver on-board "fast ethernet" 10/100
# lan0  Intel e1000 driver  PCI card "Gigabit ethernet 10/100/1000
# lan2  Realtek r8169 driver PCI card "Gigabit ethernet 10/100/1000


SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="00:50:bf:ed:e3:14", NAME="wan0"
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="90:e2:ba:ed:ef:4c", NAME="lan0"
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="6c:19:8f:9a:61:77", NAME="lan2"

In dmesg one can see the kernel assigning eth0 than renaming it. Apparently that frees the eth0 name because it assigns eth0 three times. With a rename in between, but I think the process is actually asynchronous so it just happens that way by coincidence.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Fri May 22, 2020 9:23 pm    Post subject: Reply with quote

Thank you very much for your big compliment !

Let me say something ...

I dont know which connection you have to the internet. In germany private people (today) always have a DSL-Line. Maybe you call it ADSL or SDSL (this is more exactly). On this line we have connected a Router which is a combined Router and a DSL-Modem in a box (and we can connect an ip-telephone directly to this box also). Some of these routers have 4 or 8 ethernet ports and you can use it as a switch also. You can lease this Router from the telecommunication company or buy one by yourself. All routers have a built-in ip adress from one of the 256 private class-C networks 192.168.0.0. So, the most common adress is 192.168.0.1 or 192.168.1.1 (https://en.wikipedia.org/wiki/IPv4#Addressing

This router is doing the whole NAT for any computer in my private network, so I dont need to do "NATing" (or masquerade) by any of my computers.

And almost any of these routers have a built-in firewall also (with stateful inspection). I dont trust my box from "TeleKom Germany", but I see the firewall in this box is working. I see it, because I log (on my linux workstation) every incoming dropped packet. And for weeks I had none. (I can produce some, if I close my browser in the middle of a transfer. My DSL-Modem accepts the next incoming packet from the webserver because it belongs to an existent session (this is a correct behavier). But my linux kernel knows, the session was just closed and therefore this incoming packet DOESNT belong to an existent session and must be dropped.)

Why I tell you this ?

Because, I dont know the situation in the USA for private people. And I didnt understand in your first post, whether you want to eliminate your "box" (?) - you already have - and exchange it with your computer, or just install this computer BETWEEN your "box" and your LAN (for more security ?). I didnt unserstand for what you need 3 interfaces in this computer. So, if you can explain what you have and what you want (to do) AND what is your actual problem, I will help you for sure. But for now, I even dont know if your network (networks ?) work and which adresses your networks and hosts have. An (actual) "ifconfig" would help much.

So, I go in "waiting state" for now ;-)
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Sat May 23, 2020 1:10 am    Post subject: Reply with quote

Yes. My daughter and my sister have an ADSL connection from AT&T as you describe. My sister's is a standalone and, as you say, is a DSL modem, NAT gateway and wireless AP all in one. Her service is billed as "up to 50Mbps". The installing tech measured it as 3Mbps. He said "we promised up to 50Mbps, so as long as you are getting less than that we are keeping our promise. My daughter is at the end of the line and gets a little over 1 Mbps.
They live a thousand miles South of me in a rural county. I live in a suburb of Chicago and have three providers available. I have cable internet where there is a cable modem that transmits and receives packets of a set of bonded television frequencies on a coaxial cable. this one I have a very old combination router, four port switch, and wireless AP,this one, now EOL My service is 30MBps up and 5 down. I've heard that in Europe service is symmetrical but in the USA it's much more common for the down-link speed to be much higher than the up-link speed.

My intent is to use an old Gentoo computer as a router and put the router into AP mode. The router has not had firmware updates or security fixes for many years. I update my Gentoo boxes weekly, although lately it seems to take all weekend to resolve blockers.

"Why?" is a more philosophical question. certainly I could buy one of these. After all, the US government just sent me $2400 that I don't need instead of sending it to someone that needs it. But I'm veering into politics. About face!
Why? Why did I buy an old Chevy station wagon with 100,000 miles on it and a flat cam. I then had the block rebuilt (I have the training but not the equipment) add a set of big valve aftermarket heads, an aftermarket aluminum manifold , four barrel carburetor and high lift cam? Just to watch a guy driving a late model Mustang try to cut me off and see the driver's jaw drop when I put the hammer down and flashed by him like he was standing still?
Yeah, that was rather adolescent of me and it was nearly thirty years ago. Maybe now I like to hot rod computers instead of cars. I suspect that is so.

A more practical reason is to get better logging. The commercial router has pretty much all or nothing. On the low setting I see the router rebooting, the modem attaching and detaching and that's about it. The other setting quickly loads up with reports of attackers knocking on the door, day and night, all ports. Some may be legitimate gamers looking for a game, others are probably up to no good. I would like to log traffic but just drop these unrelated unconnected packets drop silently without losing track of MY traffic. And to feel in control instead of having a black box.

EDIT:
The three interfaces. An accident of history. One (slower) is built on the motherboard. The other two are add-in cards. Why two? One Realtek, one Intel? I was going to use one for WAN and one for LAN, then realized that even the slow built-in at 100MBps is still three times faster than the internet connection. In another post two years ago, NeddySeagoon pointed out that the PCI (not PCI-e) bus was the real bottleneck. I really keep the old machine up for sentiment. My middle grandson and I built it out of discarded scraps and a $20 e-bay motherboard when I was unemployed 17 years ago. The k6-3 was pretty hot then. The guy selling it was buying a k-7. Half a Gig of memory, 32-bits and an ancient IDE hard drive (7200 RPM) aren't much now. I don't run a GUI. This is now an experimental setup. if i get it working, I'll put it on a 64-bit box with at least 4G memory. Maybe I'll even buy a motherboard and CPU. I saw a Ryzen 3 APU for $80 with 4.0Ghz burst speed. Used motherboards are pretty cheap. i have a bulldozer AM4 chip if a BIOS update is needed. When she's angry my wife will say things like "We would have lots of room in the basement if we got rid of all that car and computer #$%^&!" Two guesses who that stuff belongs to.

ifconfig, (I only am initializing one right now), see the udev rules posted above for more identification.
Code:
lan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.0.106  netmask 255.255.0.0  broadcast 192.168.255.255
        ether 90:e2:ba:ed:ef:4c  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lan2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.109  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 6c:19:8f:9a:61:77  txqueuelen 1000  (Ethernet)
        RX packets 9099  bytes 581792 (568.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14770  bytes 1824334 (1.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Sat May 23, 2020 3:47 am    Post subject: Reply with quote

Ok, removed the r8169 card (lan2). There are now only two ethernet devices
1. Built-in 100Mbps "Fast Ethernet" using Realtek 8139too driver.
2. PCI card 1000Mbps "Gigabit Ethernet" using Intel e1000 driver.

yellow cat 6 cable plugged into the PCI card, nothing into the onboard

lspci and ifconfig:
Code:
k6 ~ # lspci
00:00.0 Host bridge: VIA Technologies, Inc. VT82C598 [Apollo MVP3] (rev 04)
00:01.0 PCI bridge: VIA Technologies, Inc. VT82C598/694x [Apollo MVP3/Pro133x AGP]
00:07.0 ISA bridge: VIA Technologies, Inc. VT82C586/A/B PCI-to-ISA [Apollo VP] (rev 47)
00:07.1 IDE interface: VIA Technologies, Inc. VT82C586A/B/VT82C686/A/B/VT823x/A/C PIPC Bus Master IDE (rev 06)
00:07.2 USB controller: VIA Technologies, Inc. VT82xx/62xx UHCI USB 1.1 Controller (rev 02)
00:07.3 Host bridge: VIA Technologies, Inc. VT82C586B ACPI (rev 10)
00:08.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8100/8101L/8139 PCI Fast Ethernet Adapter (rev 10)
00:09.0 Ethernet controller: Intel Corporation 82541PI Gigabit Ethernet Controller (rev 05)
00:0b.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] RV100 [Radeon 7000 / Radeon VE]
k6 ~ # ifconfig
lan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.106  netmask 255.255.0.0  broadcast 192.168.255.255
        ether 90:e2:ba:ed:ef:4c  txqueuelen 1000  (Ethernet)
        RX packets 799  bytes 69275 (67.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 561  bytes 76811 (75.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 20  bytes 1340 (1.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 20  bytes 1340 (1.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.0.107  netmask 255.255.0.0  broadcast 192.168.255.255
        ether 00:50:bf:ed:e3:14  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


I need to change /etc/conf.d/net for actual wan use.
If I'm right, wan0 should get it's address from DHCP
lan0 should be the gateway.
Code:
k6 ~ # grep -v ^# /etc/conf.d/net

rc_verbose="no"

config_wan0="192.168.0.107 netmask 255.255.0.0"
routes_wan0="default gw 192.168.0.1"

config_lan0="192.168.0.106 netmask 255.255.0.0"
routes_lan0="default gw 192.168.0.1"
dns_servers_lan0="127.0.0.1 "

dns_servers_wlan0="127.0.0.1"
dns_servers_lo="127.0.0.1 "




modules="ethtool !iproute2"      #prefer ifconfig

modules_wlan0=" ${modules} wpa_supplicant"


carrier_timeout_lan0=10   #fix for e1000



ifdown_lan0="no"
ethtool_change_lan0="wol g"
ifdown="no"
postdown() {
      [ "${IFACE}" = "lan0" ] && ethtool -s "${IFACE}" wol g
             return 0
       }
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 46322
Location: 56N 3W

PostPosted: Sat May 23, 2020 9:17 am    Post subject: Reply with quote

Tony0945,

With both interfaces in the same subnet you are going to have routing problems.
Don't do that.

Code:
inet 192.168.0.106  netmask 255.255.0.0
inet 192.168.0.107  netmask 255.255.0.0


That's the 192.168.0.0/16 network.

You will do better with
Code:
inet 192.168.0.106  netmask 255.255.255.0
inet 192.168.1.107  netmask 255.255.255.0


That's two different subnets.
Code:
192.168.0.0/24
192.168.1.0/24


You must get your routing in order before you add a firewall.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Sat May 23, 2020 4:49 pm    Post subject: Reply with quote

Here is the configuration when used as a router.
Code:
configure WAN
config_wan0="dhcp" #get ip address and route from ISP
routes_wan0="default gw 64.53.168.1"

#configure LAN
config_lan0="192.168.0.1 netmask 255.255.255.0"
routes_lan0="default gw 192.168.0.1"
wan0's gateway is some computer at my ISP's location in Naperville Illinois. Thousands of people have that gateway. I read it off my D-link router's WAN page. Per your advice, I did not list my cable modem's IP address but it is received by dhcp and does change at random intervals. The DLink router is set to obtain address and gateway by dhcp. Should I leave "routes_wan0" line out? Will dhcp get them then?

The lan0 address is likewise copied from the router, but it is a standard default.

To run with this configuration I have disconnect the router or there will be an address conflict.
When testing, I connect wan0 directly to the cable modem. That's an easy switch although the k6 computer is some 20 feet or so away because the cable modem & router are only a few feet apart and it's easy to switch.
For testing, lan0 is attached by a short cat-5e cable to a Windows 7 laptop.
During development, lan0 is connected to the local net via Dlink router and wan0 is disconnected. I physically removed the lan2 card to remove all confusion. Then I put back a USB card that caused all sorts of boot problems (although sysrescuecd could boot XP okay). I have removed the USB card and just left the slot empty. I should examine /boot/grub/grub.conf and boot by UUID or label. There is only one hard drive, but the CD-ROM drive is on the same IDE cable.
Back to top
View user's profile Send private message
pietinger
Guru
Guru


Joined: 17 Oct 2006
Posts: 346
Location: Bavaria

PostPosted: Sat May 23, 2020 5:32 pm    Post subject: Reply with quote

Tony0945 wrote:
Here is the configuration when used as a router.
Code:
configure WAN
config_wan0="dhcp" #get ip address and route from ISP
routes_wan0="default gw 64.53.168.1"


wan0's gateway is some computer at my ISP's location in Naperville Illinois. Thousands of people have that gateway. I read it off my D-link router's WAN page. Per your advice, I did not list my cable modem's IP address but it is received by dhcp and does change at random intervals. The DLink router is set to obtain address and gateway by dhcp. Should I leave "routes_wan0" line out? Will dhcp get them then?


Tony, a gateway is a router (simply said). And you can use ONLY a router inside your own network. It is impossible to use a router (as router) which is in another network. So, at home I have the network 192.168.2.0. My workstation is 192.168.2.4 and my (default) gw for my workstation is 192.168.2.1. This is my TeleKom-Router. On the other side (internet) of my router, it is in a complete different network with its own ip-adress belonging to that network.

Maybe you mix it with a DNS-Server (nameserver) ?

If yes, you set your DNS-Server in /etc/resolv.conf
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 46322
Location: 56N 3W

PostPosted: Sat May 23, 2020 5:46 pm    Post subject: Reply with quote

Tony0945,

To avoid confusion and to save you the exercise connect wan0 to your existing router and leave the#configure WAN
Code:
config_wan0="dhcp" #get ip address and route from ISP
entry.
It will get a default route via dhcp too so rewove the
Code:
routes_wan0="default gw 64.53.168.1"


As the interface is known to your router, I expect to see it get 192.168.0.107 an its IP address.

On the lan side, use a completely different IP range, so you have to make routing work.
This is how it will actually work when it routing to the big bad internet.

Code:
config_lan0="10.0.0.1 netmask 255.255.255.0"
will do nicely.
Do not set any routes yet.
If you have a dhcp server installed, make it serve IP addresses in the range 10.0.0.101 to 10.0.0.200. That's plenty.
Make it serve 10.0.0.1 as a default route.

Your setup is
Code:
+----------+        +----------+        +----------+
| Existing |        | New      |        | Testing  |
| Router   +------A-+|Router   +-B------+ Box      |
|          |        | K6-2 Box |        |          |
+----------+        +----------+        +----------+

A IP is   192.168.0.107
B IP Is   10.0.0.1


The Testing Box is only there so you can make routing work. It won't be able connect to the internet yet. That will come.
The new router will serve the Testing Box an IP in the range 10.0.0.101 to 10.0.0.200 and default route of 10.0.0.1.
You should be able to connect from the Testing Box to the New Router. Test with ping, ssh and so on but the connections stop there. That's as expected.
Check that that much works.

From the New Router, you should be able to connect anywhere. It can get to the internet. It can reach the Testing Box too.
It uses wan0 to get to the internet and lan0 to get to the Testing Box.
Check that works too.

There is as yet no route between wan0 and lan0. That comes later.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Tue May 26, 2020 2:46 am    Post subject: Reply with quote

NeddySeagoon, that's a natural progression. At first I balked at changing the network addresses. It seemed to error-prone to change them back. Then I realized that my firewall script that sets up the tables is just that - a shell script. There is no need to hard code addresses everywhere. Simple shell variables at the top can make the changes at one spot. And the program, shellcheck, can check to scrpting errors and some typo's.
As usual, you are right and I've been hacking instead of designing - a cardinal sin that I blast others for. mea culpa.

EDIT:
I also made the mistake of reading the iptables manpage, which disoriented me even more.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Fri May 29, 2020 11:34 pm    Post subject: Reply with quote

OK. Sorry for the delay.

On the k6:
/etc/dnsmasq.conf {stripped of comments}
Code:
domain-needed
bogus-priv

filterwin2k

resolv-file=/etc/dnsmasq.conf.resolv

address=/double-click.net/0.0.0.0

interface=lan0

dhcp-range=10.0.0.101,10.0.0.200,1h

/etc/conf.d/net{likewise stripped}
Code:
rc_verbose="no"

config_wan0="dhcp" #get ip address and route from ISP

config_lan0="10.0.0.1 netmask 255.255.255.


modules="ethtool !iproute2"      #prefer ifconfig

modules_wlan0=" ${modules} "

dns_servers_lan0="127.0.0.1 "
dns_servers_wan0="127.0.0.1 "
dns_servers_lo="127.0.0.1 "

carrier_timeout_lan0=10   #fix for e1000

ifdown_lan0="no"
ethtool_change_lan0="wol g"
ifdown="no"
postdown() {
      [ "${IFACE}" = "lan0" ] && ethtool -s "${IFACE}" wol g
             return 0
       }


Ok. Going down to run a test.
Back to top
View user's profile Send private message
Tony0945
Advocate
Advocate


Joined: 25 Jul 2006
Posts: 4117
Location: Illinois, USA

PostPosted: Sat May 30, 2020 1:13 am    Post subject: Reply with quote

UPDATE: Ran the test. The laptop was dead! And I couldn't find the charger or carrying bag. It would have been perfect.
So, Plan B. Unplugged a very long (50 ft?) cat 5e cable going to a nearby wireless AP. Plugged it into than lan0 card, with the yellow cat 6 still plugged into wan0 (upper, on board socket). Unplugged the other end of the blue cable from the 10 port switch and into a nearby ancient (Athlon64) Win 7 computer after shutting said computer down. Rebooted the k6. Turned the Windows computer back on. "ipconfig" on Win7 showed address 10.0.0.104 received from gateway 10.0.0.1 Could ping the gateway (k6) and vice versa. The wan port received address 192.168.0.199 from gateway 192.168.0.1 (the Dlink router on the other end of the wan0 yellow cable. I could ssh into computers 192.168.0.104 and 192.168.0.100. From computer 192.168.0.102 I could ssh into the k6 at 192.168.0.199, I used 102 because it's there in the basement and the other two are on the first and second floors.
From the k6 I could ping 8.8.8.8 but I could not ping any address not on the lan from the Win7 computer connected to lan0.

Code:
login as: root
root@192.168.0.199's password:
k6 ~ # ifconfig -a
lan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 10.0.0.1  netmask 255.255.255.0  broadcast 10.0.0.255
        ether 90:e2:ba:ed:ef:4c  txqueuelen 1000  (Ethernet)
        RX packets 339  bytes 40513 (39.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 46  bytes 5006 (4.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 2  bytes 432 (432.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2  bytes 432 (432.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.199  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 00:50:bf:ed:e3:14  txqueuelen 1000  (Ethernet)
        RX packets 998  bytes 89843 (87.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 211  bytes 25447 (24.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


I think the next step is to setup NAT and try to use the Win7 browser to access the apache2 webpage at 192.168.0.102
That page just displays the default "IT WORKS!". It's real function is to serve distfiles to the Gentoo boxes. If I can fire up Pale Moon for windows on the Win7 box, type in http://192.168.0.102 and see "IT WORKS!", that's a milestone. If I can do it with the domain name, that's icing on the cake. Dnsmasq should resolve the domain name because it's in the k6's /etc/hosts file.

Meanwhile, I'm looking for that bag and charger because I want to use that laptop as a TV relay (tested that a few months ago). And there's that evil voice in the back of my head saying that one of my spare 2.5" SATA 500GB SSD's would be perfect for Gentoo on the laptop. Sorry, my ADDHD is showing.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Goto page Previous  1, 2, 3, 4  Next
Page 2 of 4

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum