# Setting up a Proxy/Router?

## Shienarier

I got the following scenario:

I got two computers and a cable modem.

The first computer are running gentoo and are connected to the net

through the cable modem. The second computer are about to run gentoo and need

to be connected to the net. Both computers have a NIC installed and if i am correct

the first computer need to get another NIC installed. How do i go from here?

This is what i have in mind:

Internet - Cable modem - First computer - Second computer.

By the way, is the first computer in this scenario called a proxy or a router?

It helps a lot to know such things when you are looking for HOWTOs :-)

----------

## patrickbores

You need IP Masquerading. Luckily, it's a snap to set up. First, enable these in your kernel and recompile:

Networking Options

----Network packet filtering

----IP: Netfilter Configuration

--------Connection tracking

------------FTP protocol support

--------IP tables support

------------Packet filtering

------------Full NAT

----------------MASQUERADE target support

Then, get iptables:

emerge iptables

Then, assuming your cable modem is hooked up to eth0:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Edit the line in /etc/conf.d/iptables to read:

ENABLE_FORWARDING_IPv4="yes"

Finally, run:

/etc/init.d/iptables save

Assuming that eth1 is the internal network interface, set the gateway for each computer on the internal network to the IP address of eth1.

This should get you started. I've probably left something out, but this all worked for me.

----------

## Shienarier

Thanks, i'll try that as soon as i can get the other computer up and running.

----------

## Shienarier

Sadly it didn't work.

If you got any ideas why, please tell me.

The clue that i am about to investigate is that the second NIC on the first computer (eth1) seems to work in all aspects besides that the CT light isn't lit. Which  it is on the second computer.

I have installed the second NIC as following the gentoo docs.

By the way, do you need iptable_nat.o?

In that case, how do you load it? Modprobe and modules.autoload doesn't work.

----------

## patrickbores

Are you getting any error messages?

You may also need to enable "Socket Filtering" in the kernel, if it isn't already. Try that. You might also have to have forwarding enabled BEFORE you run iptables (contrary to my previous instructions). You know that forwarding is enabled if /proc/sys/net/ipv4/conf/all/forwarding exists and contains a "1".

Also, make sure you're running iptables on startup by running:

rc-update add iptables default

And, of course, make sure a viable network exists between the two ethernet interfaces. On my setup, the internal ethernet interfaces are on the 192.168.0.0/24 network. You should be able to ping between them before you start any of this.

I would suspect you need that module, but I'm not sure. Since my box does NAT masquerading full time, I just compiled everything right into the kernel, no modules.

----------

## Shienarier

I can't send a ping between them.

But i can't for the life of me figure out why.

My guess is that eth1 isn't working.

The module gets loaded and gentoo hooks it up with correct settings.

But the light in the NIC isn't lit and i can't send a ping between the computers.

----------

## think4urs11

Hi!

Just a quick thought...

You DID use a cross connect cable between the two PC, didn't you?

direct PC<->PC connections need to have a cross cable, while PC <-> Hub <-> PC would need 'normal' cables.

HTH

T.

----------

## Shienarier

That was one of my concerns. But this is a TP.

Now i am mainly woried about that the power LED isn't on.

But it gets loaded in both linux and windows.

In windows i get the error message that the cable isn't put in the network card.

----------

## think4urs11

Hi!

Getting a module loaded and getting an interface up are two different things... so again the 'standard' questions

IS the interface eth1 up or down? (ifconfig)

IS the connection LED on or off? (looking)

HAVE you checked the settings on both sides for speed and duplex? (mii-tool)

DO you use a straight-through cable between the two PC - which would be definitve WRONG! (exchange with crossconnect twisted pair)

HTH

T.

----------

## Shienarier

I am not excactly sure about all this.

The module gets loaded (has nothing to do with the actual NIC, i know), the module also gets used (which i think has someting to do with the actual NIC). ifconfig shows me both eth0 and eth1 (and lo). The boot also sais it is ok and brings eth1 (and eth0) up.

The LED is of. The most disturbing fact. To be certain i switched the PCI port, but still the same.

I am not sure what to check for. Do they need to have the same speed and duplex?

Speed is 10 Mbps and full duplex on eth1 in computer one.

eth0 in the second computer is gentoo boot default. Not sure how to check that.

It is an ordinary TP (twisted).

----------

## think4urs11

Hi!

So we've got the problem

As long as you use a standard TP cable (means one you also use to connect your PC to a hub) it wont work.

Either get a hub/switch in between the two PC and thereby use these standard cables or you have to use a crossconnect cable which should be available in every better PC store.

To check the settings for speed/duplex with gentoo use the command

```
mii-tool -v
```

This should be either on both sides the same or auto-detect. Personally i like to have fixed values whenever possible because auto isn't always perfect and can cause some very weird probs.

HTH

T.

----------

## Shienarier

I think i got confused by the terminology.

TP (Twisted Pair) and Twisted (crossover) TP.

I alwas was confused by the term Twisted TP :-)

But now i am allright :-)

One last problem that might not do anything, but the LED?

It is lit on the second computer. It is a power on LED.

How come that isn't lit on the first computer?

It couldn't be off and still get bringed up by gentoo could it?

That besides, thanks for all the help.

----------

## Shienarier

Ok, now that a got a working network (and a second keyboard), but things aren't looking up. I can now ping between the two computers, but the second computer can't get to the net.

I have compiled this into my kernel:

Networking Options

 ----Network packet filtering

 ----Socket filtering

 ----IP: Netfilter Configuration

 --------Connection tracking

 ------------FTP protocol support

 --------IP tables support

 ------------Packet filtering

 ------------Full NAT

 ----------------MASQUERADE target support

I have gotten iptables.

I have changed ENABLE_FORWARDING_IPv4 in /etc/conf.d/iptables to read "yes".

Strangely that didn't set /proc/sys/net/ipv4/conf/all/forwarding to 1.

When i manualy checked there it was still set to 0, so i changed it to 1.

By the way, when is that supposed to change to a 1?

I have given the command:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I have given the command:

/etc/init.d/iptables save

I have set my eth1 IP (on the first computer) as the default gateway on eth on the second computer. And still i can't emerge sync (i am installing gentoo on the second computer).

I get the followinf message while running "emerge sync":

rsync: getaddrinfo: rsync.gentoo.org 873: Temporary failiure in name resolution

rsync error: error in socket IO (code 10) at clientserver.c(83)

----------

## patrickbores

Hello,

IP forwarding will be turned on at startup, assuming you added iptables to your startup scripts with this:

rc-update add iptables default

You can look inside the script and see where it sticks the "1" into the file.

Your rsync error message only indicates a DNS resolution error. Do you have name servers defined in /etc/resolv.conf?

Try doing a straight ping to an outside IP address.

----------

## Shienarier

I have added iptables to the default runlevel.

I have the following servers defined in /etc/resolv.conf:

nameserver 10.0.0.1

nameserver 10.0.0.2

(default settings i supose)

I can't send a ping to the internet from the second computer.

----------

## siti

I think 10.0.0.1 & 10.0.0.2 are just examples of dns servers.  What you want to do is goto your router (1st comp) and look at resolv.conf and then put the same values on your second comp.

If that does not work try finding out a random ip on the internet (ie : go on router and ping a website ) then record that ip.  Go on second comp and ping that ip address.  If it works then it is the a name server problem if not it is a router problem.

Also on your second computer make sure you have edited /etc/conf.d/net and made the gateway your first computers ip address.

BTW here is my /etc/conf.d/net

```

# /etc/conf.d/net:

# $Header: /home/cvsroot/gentoo-src/rc-scripts/etc/conf.d/net,v 1.7 2002/11/18 19:39:22 azarah Exp $

 

# Global config file for net.* rc-scripts

 

# This is basically the ifconfig argument without the ifconfig $iface

#

iface_eth0="192.168.1.1 broadcast 192.168.1.255 netmask 255.255.255.0"

#iface_eth1="207.170.82.202 broadcast 207.0.255.255 netmask 255.255.0.0"

 

# For DHCP set iface_eth? to "dhcp"

# For passing options to dhcpcd use dhcpcd_eth?

#

#iface_eth0="dhcp"

#dhcpcd_eth0="..."

 

# For adding aliases to a interface

#

#alias_eth0="192.168.0.3 192.168.0.4"

 

# NB:  The next is only used for aliases.

#

# To add a custom netmask/broadcast address to created aliases,

# uncomment and change accordingly.  Leave commented to assign

# defaults for that interface.

#

#broadcast_eth0="192.168.0.255 192.168.0.255"

#netmask_eth0="255.255.255.0 255.255.255.0"

 

 

# For setting the default gateway

#

gateway="eth0/192.168.1.2"

```

BTW a router is when you forward all network traffic from a client to the internet.  A proxy server is more strict, its a program that goes on a certain port such as 3128 and connects to websites or other services like smtp etc.  You can have both because having a proxy server such as squid you can have it cache websites eg: you browse a website such as www.gentoo.org org on the first comp and then go on the second comp and that page should load really quickly.  A proxy server can also have authentation etc.

----------

## Shienarier

Both computers have the same values in resolv.conf.

But i don't think that any of them actualy uses them.

I can't ping or do anything further than the local LAN from the second computer.

The second computers default gateway are the IP of eth1 in the first computer.

I think that the problem now is my n00biness with iptables.

I can't seem to flush the chains.

the command /sbin/iptables-save gives me this:

# Generated by iptables-save v1.2.8 on Sat Aug  9 12:07:01 2003

*nat

:PREROUTING ACCEPT [79931:4015721]

:POSTROUTING ACCEPT [37017:2064705]

:OUTPUT ACCEPT [84860:4791593]

-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

# Completed on Sat Aug  9 12:07:01 2003

# Generated by iptables-save v1.2.8 on Sat Aug  9 12:07:01 2003

*filter

:INPUT ACCEPT [2850068:1834394709]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [2661133:801669247]

COMMIT

# Completed on Sat Aug  9 12:07:01 2003

iptables -L gives me this:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

Aren't they supposed to be the same?

I have used /etc/init.d/iptables save after iptables -F.

----------

## siti

I did not use the iptables script but made my own firewall script, I think you would need to edit it as I have dialup not dsl:(

```

#!/sbin/runscript

 

depend() {

provide fire_wall

}

 

start() {

ebegin "Starting Firewall and Enabling Routing"

echo "1" > /proc/sys/net/ipv4/ip_forward

/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

/sbin/iptables -A INPUT -i ppp0 -p tcp --destination-port 0:1024 -j DROP

/sbin/iptables -A INPUT -i ppp0 -p udp --destination-port 0:1024 -j DROP

eend $?

}

 

 

 

stop() {

ebegin "Stopping Firewall and Disabling Routing"

echo "0" > /proc/sys/net/ipv4/ip_forward

iptables -F

eend $?

}

```

----------

## Shienarier

I don't think that i have any problems there.

It's just that iptables -F doesn't flush the chains.

As i belive it is supposed to.

That implies (to me anyway) that there

is something else that is wrong.

----------

## siti

What kernel are you using?

You could try a different kernel such as vanilla-sources, if you are using gentoo-sources I have seen an iptables problem, I don't know if it is fixed yet though.

----------

## patrickbores

I don't think iptables -L lists the POSTROUTING table by default. That's why they don't list the same information.

Your iptables-save output looks just like mine though. I'm using ck-sources for my kernel.

Patrick

----------

## Shienarier

I am using the gentoo-sources.

I better go look at a vanilla one.

----------

## Shienarier

It works now with kernel 2.4.21.

----------

## siti

Cool!!!

It took me ages to get routing working.  Now it seems so simple but it wasn't then!

----------

