# Home-Router Failure

## Daniel_walmsley

Hi

I have just set up a gentoo install exactly as stated inte home router how to in the administration docs. however it does not route from the lan network i can ping the wan interface on the router however I cannot ping the adsl router connected to the nic on the wan side of the router. I have tryed several diffent setups of iptables include just straight fowarding with out any sort of filtering and still no luck. I have tested the same iptables rules as in the howto on a red hat box and it worked fine. Does any one have any idea as to what is happening.

Also does any one know of any good docs that explain iptables to some on with ccna.

Thanks

----------

## adaptr

 *Daniel_walmsley wrote:*   

> I cannot ping the adsl router connected to the nic on the wan side of the router.

 

That's because the home router guide assumes that you have a modem connected to your router, not another router.

 *Daniel_walmsley wrote:*   

>  I have tryed several diffent setups of iptables include just straight fowarding with out any sort of filtering and still no luck.

 

You remembered to enable forwarding in the kernel, yes ?

```
echo "1" > /proc/sys/net/ipv4/ip_forward
```

 *Daniel_walmsley wrote:*   

>   I have tested the same iptables rules as in the howto on a red hat box and it worked fine.

 

Then the above is probably the difference.

 *Daniel_walmsley wrote:*   

> Also does any one know of any good docs that explain iptables to some on with ccna.

 

Truly ? No.

Iptables is much, much more powerful and flexible than any Cisco box  :Wink: 

But you should probably start with the official documentation:

http://netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html

----------

## Daniel_walmsley

OK well im glad that iv found the source of the problem 

Thanks for you help 

Yeah i did all that from the guide 

 *Quote:*   

> You remembered to enable forwarding in the kernel, yes ? 
> 
> Code: 
> 
> echo "1" > /proc/sys/net/ipv4/ip_forward 
> ...

 

Does any one know how i can set up the following 

[LAN]<->(eth0{gentoobox}eth1)<->[ADSL router]<->[wan]

Lan = 192.168.1.0 255.255.255.0

eth0 = 192.168.1.2

eth1 = 192.168.0.2

Adsl router = 192.168.0.1

I just wanna have a basic unsecure setup to start so i can just have a plain unfiltered route thru the gentoo box so i can play with some bandwidth monitoring tools

If any one can help that'd be great

Im off t0 rtfm  :Laughing: 

Thanks

----------

## Daniel_walmsley

This line gave me unsecured routing as i wanted it \

```
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
```

I dont get it tho I got that from the nat howto but that same line is in the home router howto 

is any one able to tell me what happend?

----------

## adaptr

 *Daniel_walmsley wrote:*   

> This line gave me unsecured routing as i wanted it \

 

Once again, no it doesn't.

That is NAT masquerading, not routing.

```
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
```

 *Daniel_walmsley wrote:*   

> I dont get it tho I got that from the nat howto but that same line is in the home router howto 
> 
> is any one able to tell me what happend?

 

Not really, since you don't show what you did earlier - there is no basis for comparison.

If all you want to do is route over the Gentoo box then you should do that - it has nothing to do with iptables.

For this to work you do have to be able to add the route for your internal LAN to the modem-router; not all of them allow this.

----------

## Daniel_walmsley

its workin i have my bandwidth monitoring setup who cares if its nat not routing.

for routing wouldnt i have to tell the gentoo box every network avalaible on the wan side?

----------

## Daniel_walmsley

I found where it all whent to custard this line here 

```
iptables -I FORWARD -i eth0 -d 192.168.0.0/255.255.0.0 -j DROP
```

With out it all works fine any one able to tell me what it does

----------

## adaptr

 *Daniel_walmsley wrote:*   

> its workin i have my bandwidth monitoring setup who cares if its nat not routing.

 

Well, you might - unless you don't care to understand how to solve your problems.

After all, hit-and-miss probably gets you out of the woods 1 time in a 100.

No more than that, though.

 *Daniel_walmsley wrote:*   

> for routing wouldnt i have to tell the gentoo box every network avalaible on the wan side?

 

Fine, ignore what I wrote.

----------

## Daniel_walmsley

 *Quote:*   

> Fine, ignore what I wrote.

 

Im trying to understand what u wrote not ignoring it

----------

## adaptr

Well, okay - how's this:

- to truly understand the issues involved you will need to read quite a bit about TCP/IP networking, routing, and the Linux networking tools.

Say, 3 to 6 months to get the basics down and become comfortable with the tools involved.

What I wrote, OTOH, is what you can do right now and make it work - I assume that's what you want ?

Double-NATting over two routers is almost always avoidable, and introduces both overhead and unneeded complexity.

----------

## Daniel_walmsley

The thing is i just got my ccna and have found that i would rather have an understanding of more than just cisco gear

isdn and a few propratry cisco routing protocols.

I was however looking for a quick fix and was happy with double nating as the extra over head is not really noticable on an 11 computer net work. 

But what I dont under stand is all i want is a static route so all traffic not of the 192.168.1.0 /24 should go out the 

interface eth1 (192.168.0.2) and be sent to the crapy D-link router 

I thought that was what the home router how to was meant to tell you how to do.

And yeah i think i need to reed up a bit more on iptables before i start buggin ppl on the forums.

----------

