| View previous topic :: View next topic |
| Author |
Message |
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
 Posted: Wed May 10, 2006 1:08 pm Post subject: question about using machine as a router |
 |
|
hi. i am wondering something in class we started using 2003 server as a router to configure networks. what i'd like to know is how i can set up some sort of routing service like how 2003 server has on gentoo. i have read the home routing guide but i am not sure if thats all i need or not cause it didn't mention anything about routing tables well not that i saw. so can anyone point me somewhere or help? TIA
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
 |
bkunlimited
l33t
Joined: 18 Jun 2004
Posts: 672
|
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Wed May 10, 2006 2:07 pm Post subject: |
|
|
umm...when it gives that kernel config info how do i get that?
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
bkunlimited
l33t
Joined: 18 Jun 2004
Posts: 672
|
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Wed May 10, 2006 2:52 pm Post subject: |
|
|
ok i really hate to be a pain but... how in the world do i set up the routing table? i forgot to mention this but firewalls proxies don't use em we don't even connect to the internet with the yet. i am just trying to connect multiple networks together but i don't see where in that guide that takes place or maybe i just can't understand it  again sorry to be a pain.
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
bkunlimited
l33t
Joined: 18 Jun 2004
Posts: 672
|
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Thu May 11, 2006 2:22 pm Post subject: |
|
|
if thats for newbies then i am a lost hope all it seems to talk about is firewall this and firewall that. its all so confusing i appreaciate your help though so thanks
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Thu May 11, 2006 2:52 pm Post subject: Oyyyy |
|
|
Ok,
Let's clear a couple things up. With all due respect to the previous poster, routing is NOT done with iptables. Firewalling is done with iptables. There's a difference.
As for the routing table, the first thing you need to do is set up your interfaces on your brand new linux router, and your initial routing table will take care of itself. Say, for instance, you have two networks that you want to connect. Call them LAN A and LAN B. Your Linux router has two interfaces, eth0 and eth1. You want to connect them to these networks. Go ahead and cable them to the two switches eth0 to LAN A and eth1 to LAN B and set them up like this (modify as you see fit)
eth0: 192.168.1.1 netmask 255.255.255.0
eth1: 192.168.2.1 netmask 255.255.255.0
There is clear documentation on the internet in Linux HOWTOs etc that will explain the concept of TCP/IP networking and how to get this far.
Once you get your system set up like this, take a look at your routing table. Just type the command. You will see the routing table in all its glory. If you have the iproute2 package installed, type to see the table, layed out a bit differently.
At this point, to get routing working you don't even have to touch this table. You just need to make sure your Linux kernel is configured to forward IP traffic. Take a look at /etc/sysctl.conf and the files in /proc/sys/net/ipv4 (in particular, the ip_forward file). Once you get forwarding active, set up two workstations, one on each LAN. Configure them to work on the LAN (for LAN A, something like 192.168.1.5/255.255.255.0 and for LAN B 192.168.2.5/255.255.255.0)
Now, you should be able to ping from one workstation to the other. On the linux router, type and you can watch the ping packets going by. Of course, you need to have tcpdump installed.
At this point, you are done Phase 1. You have the world's simplest Linux Router working. Study that routing table, and make sure you understand every single entry. It gets complicated and much more interesting, if you have to connect to another router (such as your internet router, for instance). Only then do you need to start modifying that routing table. To practice with this, I would suggest setting up a second Linux Router on LAN B, which connects to a new LAN C. Then make sure 3 workstations can ping each other on all 3 LANs.
When you get this far, you'll begin understanding how routing works. THEN you have two directions you can go, to begin building on top of that.
1. firewalls with iptables
2. VPNs
Important, though, is that both firewalling and VPNs will remain a mystery until you master routing.
Good Luck. |
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Fri May 12, 2006 1:10 pm Post subject: |
|
|
wow. thats the kind of stuff i've been looking for.
ok my /etc/sysctl.conf
| Code: |
# /etc/sysctl.conf
#
# For more information on how this file works, please see
# the manpages sysctl(8) and sysctl.conf(5).
#
# In order for this file to work properly, you must first
# enable 'Sysctl support' in the kernel.
#
# Look in /proc/sys/ for all the things you can setup.
#
# Disables packet forwarding
#net.ipv4.ip_forward = 0
# Disables IP dynaddr
#net.ipv4.ip_dynaddr = 0
# Disable ECN
#net.ipv4.tcp_ecn = 0
# Enables source route verification
net.ipv4.conf.default.rp_filter = 1
# Enable reverse path
net.ipv4.conf.all.rp_filter = 1
# Enable SYN cookies (yum!)
# http://cr.yp.to/syncookies.html
#net.ipv4.tcp_syncookies = 1
# Disable source route
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv4.conf.default.accept_source_route = 0
# Disable redirects
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv4.conf.default.accept_redirects = 0
# Disable secure redirects
#net.ipv4.conf.all.secure_redirects = 0
#net.ipv4.conf.default.secure_redirects = 0
# Ignore ICMP broadcasts
#net.ipv4.icmp_echo_ignore_broadcasts = 1
# Disables the magic-sysrq key
#kernel.sysrq = 0
# When the kernel panics, automatically reboot in 3 seconds
#kernel.panic = 3
# Allow for more PIDs (cool factor!); may break some programs
#kernel.pid_max = 999999
# TCP Port for lock manager
#fs.nfs.nlm_tcpport = 0
# UDP Port for lock manager
#fs.nfs.nlm_udpport = 0
|
so what do i enable here? and as for the ip_fowarding file it's just an empty file that i get a "0" from it i cat it.
thanks for your help alot.
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Fri May 12, 2006 1:35 pm Post subject: |
|
|
In real time, you can do | Code: | | echo 1 > /proc/sys/net/ipv4/ip_forward |
and this will immediately enable forwarding.
To make it permanent, uncomment the first line of the above file you quoted, and change the 0 to a 1
| Code: | # Disables packet forwarding
net.ipv4.ip_forward = 1
|
And you're done.
I would seriously recommend sitting down and spending the time to go through the Linux Networking and TCP/IP HOWTO documents. They are well-written and informative. You will learn quite a bit. We Linux nerds are very lucky. We get to experiment with one of the best TCP/IP stacks in the world. Take advantage of it. |
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Fri May 12, 2006 3:53 pm Post subject: |
|
|
umm have i bit of a strange issue here the computer i have connected to the router can ping the default gateway (192.0.0.254) but he can't ping another server on the network besides 192.0.0.77 i can of course so what going on? mind you i am the only linux machine on this network.
| Code: |
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
206.0.0.0 192.0.0.10 255.255.255.0 UG 0 0 0 eth0
205.0.0.0 192.0.0.77 255.255.255.0 UG 0 0 0 eth0
202.0.0.0 * 255.255.255.0 U 0 0 0 eth1
203.0.0.0 192.0.0.11 255.255.255.0 UG 0 0 0 eth0
192.0.0.0 * 255.255.255.0 U 0 0 0 eth0
loopback localhost 255.0.0.0 UG 0 0 0 lo
default 192.0.0.254 0.0.0.0 UG 0 0 0 eth0
|
thats pretty much the entire network for the exception of two LANs (201.0.0.0, 204.0.0.0)
i can't seem to get my client computer to ping anyone besides 192.0.0.77 but i can
also i am trying to look up those networking howtos like you said.
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Fri May 12, 2006 5:57 pm Post subject: Wowzer! |
|
|
Ok, it looks like you've got quite the network set up already.
So, let me get this straight. You have Your Linux router, PLUS 4 other routers on the same segment?
192.0.0.10
192.0.0.77
192.0.0.11
192.0.0.254
What is the IP address of your Linux router?
You are talking about a client on the network - which network? Is the client on this 192.0.0.0/24 network?
What is the client's gateway?
You need to follow the path that the ping would take. At every step of that path you need to examine whether the router at that step knows how to get to the destination. Then do the same for the return pathway.
It doesn't matter if you're the only machine on the network. With properly configured IP, anyone can ping anyone. |
|
| Back to top |
|
|
F-0_ICE
l33t
Joined: 06 Dec 2004
Posts: 679
|
| Posted: Sat May 13, 2006 2:35 am Post subject: Re: Wowzer! |
|
|
| thepustule wrote: | Ok, it looks like you've got quite the network set up already.
So, let me get this straight. You have Your Linux router, PLUS 4 other routers on the same segment?
192.0.0.10
192.0.0.77
192.0.0.11
192.0.0.254
|
yes indeed that is correct. and its not just me its my whole class  the client machine belongs to my friend who up till a day or 2 ago he was the router. thats what made me want to try this on gentoo
eth0 has 192.0.0.89/24 gw 192.0.0.254
eth1 is setup as 202.0.0.1 no gw
the client is connected to the router with the ip 202.0.0.2/24 and a gateway of 202.0.0.1
it seems like some part of the routing is working since the client can ping 192.0.0.11 and part of its sub-network:205.0.0.1
but thats the only other network the client can ping. but thats where things stop working its as if i can only route to one network at a time or something.
thanks for helping me with this.
_________________
~AMD64
AMD: Athlon64 X2 3800+
2G PC3200
ATI: RADEON HD 4350
Linksys: WMP54G
True Knowledge is Best Acquired Through Experience. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Sat May 13, 2006 3:02 am Post subject: |
|
|
At this point I think you need to check the configurations of the other 192.0.0.0/24 machines.
If your client has your router as its gateway, chances are your pings are getting to every machine ok. You just need to check if the other machines know how to get back to the client.
As an example, let's follow the likely path your ping takes when you try to ping 192.0.0.77 from your client 202.0.0.2. It seems your client cannot ping 192.0.0.77.
Well, let's look at 192.0.0.77. I bet it's gateway is 192.0.0.254, judging from how your router is set up. So, the ping from your client arrives at 192.0.0.77, and then that host sends back the reply.
BUT, it knows that your client (202.0.0.2) is not on it's own subnet, so it does the only thing it knows how to do - it forwards the ping response to it's gateway (192.0.0.254).
NOW, the important part - does 192.0.0.254 know how to reach the 202 network? THAT is likely where your problem is.
You might need to put a static route into 192.0.0.254, telling it to send all traffic bound for 202.0.0.0/24 to 192.0.0.89
Just follow the ROUND TRIP PATH of the ping every step of the way, and make sure each router knows how to complete the loop. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Sat May 13, 2006 3:07 am Post subject: |
|
|
....AND once you're sick and tired of putting static routes into every router on your network, you'll be good and ready for the next step: ROUTING PROTOCOLS.
Learn RIP and OSPF. Once you have them set up, your routers will just talk to each other and auto-fill their routing tables with information about how to get to every corner of your complicated network.
FUN! |
|
| Back to top |
|
|
|
Networking & Security
