# Internet sharing, need help!

## bjfontai

Hi,

I've searched the forums, read the FAQ's, beat my head on the desk, but I still can't find anything that works... here's a little background

My Gentoo box has 2 NIC cards in it, both working properly... eth0 is connected to a cable modem, eth1 is connected to the other computer via a crossover cable.

eth0 (my cable modem) gets its ip dynamically, I've set up eth1 as a dhcpd server and the other computer (running Win98) gets an IP address and pings the host just fine (and the gentoo box pings the Win box just fine) - so they're talking to each other.

I've emerged iptables, I can modprobe iptable_nat without any problems, (so all the good stuff should be in the kernel) do I need to start iptables (/etc/init.d/iptables start) and if so when, and given this configuration how do I set up iptables to share the internet with the Win box??  I'm at a complete loss here, everything I've tried has failed, maybe it's just something simple but any help is appreciated

Thanks in advance

----------

## Sarphim

I have just recently done the same thing.  basically the iptables rules are

```

iptables -t nat -F

iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

iptables -A FORWARD -j LOG

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

```

also make sure full NAT support is compiled into yer kernel.

you also need to turn on ip forwarding.  The best option is to 

```

rc-update add iptables default

```

then edit the /etc/conf.d/iptables to and change

```

ENABLE_FORWARDING_IPv4="no"

to

ENABLE_FORWARDING_IPv4="yes"

```

then a restart should take care of everything

----------

## bjfontai

Ok, I did the preceding, but still no luck - here's a little output, and hopefully someone can help me get to the bottom of this...

iptables are now found in runlevel "default" 

  (rc-update iptables default)

/etc/conf.d/iptables now has the line 

  ENABLE_FORWARDING_IPv4="yes"  

/etc/modules.autoload now has the line 

  "iptable_nat" in it... 

First lsmod

```
ipt_MASQUERADE          1848   1  (autoclean)

iptable_mangle          2008   0  (autoclean) (unused)

ipt_LOG                 3224   1  (autoclean)

ipt_state                536   1  (autoclean)

iptable_filter          1612   1  (autoclean)

iptable_nat            21144   1  [ipt_MASQUERADE]

ip_conntrack           29056   2  [ipt_MASQUERADE ipt_state iptable_nat]

ip_tables              13656   8  [ipt_MASQUERADE iptable_mangle ipt_LOG ipt_state iptable_filter iptable_nat]

```

And now, output of iptables -L -n

```
Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

LOG        all  --  0.0.0.0/0            0.0.0.0/0          LOG flags 0 level 4

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

```

So far, the only thing I can ping on the Win box is the gateway...

----------

## bart

Did you fill in the address of the gateway on your Win box (network settings)?

----------

## bjfontai

Yes, the Win box gets it's info dynamically, so essentially - the gateway address is filled in, again - they both ping each other fine... but still no net.

----------

## darktux

```

cat /proc/sys/net/ipv4/ip_forward
```

Does that return 1?

iptables -F

iptables -I INSERT -t nat -A POSTROUTING -i eth1 -j MASQUERADE

Try that, and tell us what was the result..

----------

## bjfontai

cat /proc/sys/net/ipv4/ip_forward does indeed return a "1"

iptables -I INSERT -t nat -A POSTROUTING -i eth1 -j MASQUERADE actually returns an error code: 

```
iptables v1.2.7a: Can't use -A with -I
```

----------

## darktux

Ups   :Embarassed: 

I meant iptables -t nat -I POSTROUTING -i eth1 -j MASQUERADE

----------

## bjfontai

that gives me the following error:

```
iptables v1.2.7a: Can't use -i with POSTROUTING
```

----------

## darktux

 :Embarassed: 

This just isn't my day..

iptables -t nat -A POSTROUTING -s ip.of.the.client -j MASQUERADE

 :Embarassed: 

----------

## bjfontai

 :Crying or Very sad: 

Nope, still nothing - any particular output you'd like to see? 

By ip.of.the.client I'm assuming you mean the Win box, with the Gentoo box being the host - at the moment it's 192.168.0.114 (just to make sure we're on the same page)

----------

## darktux

This 2 things (the echo and this iptables line) is everything you need to do to share the connecting, on the firewall level. If still it isn't working check your dhcpcd settings, as well as the ones on your Windows box.

----------

## bjfontai

Ok, to that end.. here's some more information, The Win box gets it's IP dynamically from the DHCPD server running on the Gentoo box, here's what it says right now:

```

IP ADDRESS - 192.168.0.114

SUBNET MASK - 255.255.255.0

DEFAULT GATEWAY - 192.168.0.1

DHCP SERVER - 192.168.0.1

```

The Gentoo box is the DHCPD server, here's how it's set up

```

/etc/dhcp/dhcpd.conf

ddns-update-style none;

subnet 192.168.0.0 netmask 255.255.255.0 {

        #default gateway

        option routers 192.168.0.1;

        option subnet-mask 255.255.255.0;

        option domain-name "HOME_NET";

        option domain-name-servers 192.168.0.1;

        range dynamic-bootp 192.168.0.16 192.168.0.253;

        default-lease-time 21600;

        max-lease-time 43200;

}

```

```

/etc/hosts

255.255.255.255 all-ones

127.0.0.1       localhost

```

```

/etc/conf.d/net

iface_eth1="192.168.0.1 broadcast 192.168.0.255 netmask 255.255.255.0"

iface_eth0="dhcp"

```

From the Win box - I can ping 192.168.0.1 (the host) and get a response.

From the Gentoo box - I can ping 192.168.0.114 (the client) and get a response

Internet sharing however, I don't get.  Perhaps there are some steps I need to do after setting up iptables, like restarting iptables (/etc/init.d/iptables restart) or rebooting, or maybe just find a pick axe   :Wink: 

----------

## herbie

You seem to be pointing you client to your gateway as a nameserver, do you have a working nameserver running on your gateway machine? if not try changing the domain-name servers in dhcpd.conf to the ones supplied by your isp or try pinging an external ip instead of a hostname from your client (eg ping 216.239.57.101).

Herbie.Last edited by herbie on Mon Feb 17, 2003 5:00 pm; edited 1 time in total

----------

## darktux

Try to ping altavista.com from the windows box. If it doesn't work (which probably won't) try doing ping 209.73.180.8, if it does work, that means that you don't have a name server running on your gateway and that herbie assumes correctly

----------

## bjfontai

That's It - give yourselves a pat on the back... and now some closing info for those listening in.... 

So it wasn't that internet sharing didn't work, it's that I didn't give a way for my Win box to resolve names like http://www.yahoo.com to their IP addresses, the IP addresses themselves pinged fine.... so I changed this line

```

/etc/dhcp/dhcpd.conf

option domain-name-servers 192.168.0.1;

to

option domain-name-servers 207.69.188.185, 207.69.188.186, 207.69.188.187;

```

that last group of numbers is from the file /etc/resolv.conf

Thanks again guys, I appreciate all your help!

----------

## darktux

You're very welcome   :Wink: 

----------

