# NAT and local LAN issues

## trigger-happy

Installed gentoo now and i'm struggling to emerge everything i need while the weather outside makes "short" work of my phone lines... So far everything's good but I still have 1 problem that will guarantee me eternal nagging from my sister: I can't seem to get the NAT configs to work. To state the problem simply, I can connect to the internet while she can't. To make things worse, our computers can't ping each other. Everything works fine in windows so hardware is out. I practically flushed everything in iptables and it still doesn't work. Anything special I should do to just be able to ping her computer? I have a feeling this has something to do with /etc/conf.d/net but I don't really know what to do... please help before my sister brings in the chainsaw T_T

--trigger-happy

Mod edit: Split from topic 482286,  --kallamej

----------

## intmain

Could you post your /etc/conf.d/net and the network configuration of your sister's machine?

----------

## trigger-happy

this is what i have for my /etc/conf.d/net:

config_eth0=( "192.168.0.1 netmask 255.255.255.0 broadcast 192.168.0.255" )

config_eth1=( "192.168.1.100 netmask 255.255.255.0 broadcast 192.168.0.255" )

Note: i set those according to how my fedora (which is gone now) and windows. I was also forced to model my network such that it followed the windows internet connection sharing rules (192.168.0.1 and stuff). Eth0 connects to the internet while eth1  to lan fyi.

ipconfig /all from sister's comp:

windows ip configuration::

host name: maureen

primary dns suffix:

node type: mixed

ip routing enabled: no

wins proxy enabled: no

Ethernet adapter local area connection::

connection-specific dns suffix:

description: CNet PRO200 PCI

dhcp enabled: no

ip address: 192.168.0.2

subnet mask: 255.255.255.0

default gateway: 192.168.0.1

dns servers: 58.69.254.43

192.168.0.1

I really don't want to change the settings on my sister's computer as much as possible. I've had nightmares configuring her computer just to play well with my windows when it came to ICS...

-trigger-happy

----------

## at240

Have you had a look at this: http://www.gentoo.org/doc/en/home-router-howto.xml#doc_chap5

The section on the firewall should get your NAT up and running. 

When you have time, and when your sister has put away the chainsaw, I'd recommend looking into shorewall. There's a good howto which details how to run it on a LAN gateway. A lot more user-friendly than iptables.   :Smile: 

HTH,

at240

----------

## intmain

 *trigger-happy wrote:*   

> 
> 
> config_eth0=( "192.168.0.1 netmask 255.255.255.0 broadcast 192.168.0.255" )
> 
> config_eth1=( "192.168.1.100 netmask 255.255.255.0 broadcast 192.168.0.255" )
> ...

 

Are you sure that eth0 connects to the internet? According to your IP configuration eth0(192.168.0.1/255.255.255.0) connects to your sister's computer (192.168.0.2/255.255.255.0).

Have you added both net.eth0 and net.eth1 to your default-runlevel?

----------

## trigger-happy

at240, I checked that link long ago together with many other tuts on how to get my linux box NATing connections. I'll give shorewall a look though.

intmain, as odd as it seems, it's true that eth0 connects to the internet and eth1 to LAN. I copied my settings from my fedora and windows. The actual reason why my settings are as such is due to the absurd way windows wanted me to set up the network. If worse comes to worse, I'll change the settings to fit gentoo's needs, but as it stands, I don't want 3 weeks of insanity to get it working to go down the drain @_@.

My actual concern is really the fact that I can't ping her computer even with iptables flushed completely... She can't ping mine either. While on the other hand, everything is fine in windows. Did I miss anything?

--trigger-happy

----------

## Zi7

You're right to start by having a working ping between your host: right now you have a fairly simple network design problem that doesn't have anything to do with the OSes running on each of your boxes.

Once you can ping your sister ok and your box can surf the net at the same time, NAT is really easy to put on.

There seems to be a very simple reason why you can't ping your sister's computer:

You tell us she's connected to eth1 (your 192.168.1/24 LAN network) while being 192.168.0.2 (192.168.0/24 network, iow eth0).

Thus, if you try to ping 192.168.0.2 from your machine, the packet will go on eth0. As your sister is on eth1, she's never gonna get it.

If i remember well how windows handles automaticly connection sharing, 192.168.0.1 is the gateway adress on the LAN (In your case, your own box on eth0). Thus the WAN (internet) should be eth1.

There are good chances that everything works ok if you just switch your network plugs (or the eth0/eth1 configs). You should at least be able to ping your boxes this way.

Also, you've got a typo in your eth1 config: broadcast should be 192.168.1.255

Good luck!

----------

## trigger-happy

Thanks for replying. With regards to the typo, that's just in my post, the config file is correct. For the switching of settings in conf.d/net, I've done that to no avail. For switching the plugs...I'm not every fond of re-tweaking the network settings for my windows and hers. I'll have to plan out my actions 1st before I do anything crazy that would grant 3 weeks of insanity again..

What really bothers me is the fact that these settings work perfectly with fedora...

Here's something new, I tried to do ping -I eth1 192.168.0.2 and i didn't receive any packets, i tried 192.168.0.3 and i get destination host unreachable messages. Any ideas why this is so?

--trigger-happy

----------

## Zi7

 *trigger-happy wrote:*   

> Here's something new, I tried to do ping -I eth1 192.168.0.2 and i didn't receive any packets, i tried 192.168.0.3 and i get destination host unreachable messages. Any ideas why this is so?
> 
> --trigger-happy

 

That very much looks like a firewall issue...

Here's what you should do: boot your box on gentoo with your usual config, connect it to the internet and come on this forum. Reboot your sister's computer. Then, give us the following info:

While you're attempting to make things work, get rid of your firewall altogether: flush all rules and set policies to ACCEPT. Paste for us the result of:

```
iptables -L -vn

iptables -t nat -L -vn

cat /proc/sys/net/ipv4/ip_forward
```

Just for the sake of security, make sure that you don't have any network service up running while you're connected to the internet with your firewall off. The following command should yield no result:

```
netstat -lntup
```

Then paste here the results of these commands:

```
ifconfig

route -n

ping 192.168.0.2
```

Please paste also the content of /etc/conf.d/net

Finally, tell us what gives a ping attempt from your sister's computer (192.168.0.2) to your gentoo box with this config, and also on which network interface she's wired to on your gentoo box.

 *Quote:*   

> I'm not every fond of re-tweaking the network settings for my windows and hers. I'll have to plan out my actions 1st before I do anything crazy that would grant 3 weeks of insanity again...

 

I can assure you what you're trying to achieve is easy to do when you know what you're doing. Now that you've come to us, this thing is gonna work quick if you give us proper feedback, don't worry.  :Smile: 

I'm pretty sure we can work this out as soon as we have all these data at once.

----------

## trigger-happy

I'll give it a try something over the weekend. Reason for that is because my sister isn't allowed to use her computer during weekdays (more bandwidth for me XD). Right now I'm trying to stuff more things into my gentoo installation and configuring it according to my tastes.

PS.

I found out that I got messed up..indeed the configurations of eth0 and eth1should've been swapped (i double checked my windows installation network settings and err..yeah..). I'll see 1st if things go well after the swap, if not, I'll use the steps in the above post  :Smile: 

--trigger-happy

----------

## jrllop

I'm having the same problem as trigger happy. I'm trying to configure a home router but I can't even get a ping to the lan. 

Here's my setup, 

Internet -> Wireless Router -> radio waves -> Lucent Wavelan (eth0) -> my laptop -> Xircom Ethernet card (eth1) -> cable -> other computer

I'm typing on this laptop right now, so connection to the internet works great   :Very Happy: 

I've flushed all of my iptables rules

```
iptables -F

iptables -t nat -F
```

I tried ping with broadcast (nothing there)

I started a tcpdump on eth1,  then hitched the other end of the cable to an old Linksys wap11. 

No traffic registered (the wap11 tries to find a router as soon as it's plugged in)

I'm using kernell 2.6.16-gentoo-r7

I'm really at my wits end. 

here are my configs:

/etc/dnsmasq.conf

```
#settings made by Jesse

dhcp-range=192.168.0.100,192.168.0.250,72h

interface=eth1

# Configuration file for dnsmasq.

#

# Format is one option per line, legal options are the same

# as the long options legal on the command line. See

# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.

#here would follow more stuff, which I carefully checked and it's all commented out

```

/etc/conf.d/net

```
# This blank configuration will automatically use DHCP for any net.*

# scripts in /etc/init.d.  To create a more complete configuration,

# please review /etc/conf.d/net.example and save your configuration

# in /etc/conf.d/net (this file :]!).

config_eth0=( "dhcp" )

 config_eth1=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.255.0" )

# config_eth1=( "dhcp" )

```

----------

## Zi7

Can you please paste here the output of:

```
ifconfig
```

----------

## jrllop

Okee doke, here's my ifconfig output

```
eth0      Link encap:Ethernet  HWaddr censored:81

          inet addr:192.168.150.38  Bcast:192.168.150.255  Mask:255.255.255.0

          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:23685 errors:0 dropped:0 overruns:0 frame:0

          TX packets:14870 errors:12 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:24673365 (23.5 Mb)  TX bytes:2439668 (2.3 Mb)

          Interrupt:3 Base address:0x100

eth1      Link encap:Ethernet  HWaddr censored:70

          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:0 (0.0 b)  TX bytes:2948 (2.8 Kb)

          Interrupt:11 Base address:0x1000

lo        Link encap:Local Loopback

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:148 errors:0 dropped:0 overruns:0 frame:0

          TX packets:148 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0

          RX bytes:7604 (7.4 Kb)  TX bytes:7604 (7.4 Kb)
```

----------

## jrllop

By the way, here's the output for

```
# route -n

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.150.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

127.0.0.0       127.0.0.1       255.0.0.0       UG    0      0        0 lo

0.0.0.0         192.168.150.1   0.0.0.0         UG    0      0        0 eth0
```

----------

## Zi7

Looks ok.

Did you try to ping specifically that other computer of yours on your eth1 LAN?

By the way, it seems your laptop and the other comp are back-to-back. Are you using a crossed cable?

----------

## jrllop

I wasn't using a crossover, now I am. And it works (so far). I had suspected that I had a physical layer problem. but everything seemed to work and I tried multiple cables (all normal). I hadn't figured that cross-over was necessary, but now I realize that these are both old ethernet cards, thus neither have the automatic cross over.

----------

## Zi7

Good to hear.  :Smile: 

----------

## trigger-happy

Well, it's friday and I was hoping that something right would happen but noo~. I still can't ping her computer...

I'll try finding time to do the steps you guys posted, but as of the moment...my sister demands internet....

--trigger-happy

----------

## trigger-happy

iptables -L -vn:

```

Chain INPUT (policy ACCEPT 52199 packets, 53M bytes)

 pkts bytes target     prot opt in     out     source               destination 

Chain FORWARD (policy DROP 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination 

Chain OUTPUT (policy ACCEPT 43875 packets, 4896K bytes)

 pkts bytes target     prot opt in     out     source               destination

```

iptables -t nat -L -vn:

```

Chain PREROUTING (policy ACCEPT 840 packets, 119K bytes)

 pkts bytes target     prot opt in     out     source               destination 

Chain POSTROUTING (policy ACCEPT 7733 packets, 429K bytes)

 pkts bytes target     prot opt in     out     source               destination 

   14  1727 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0 

Chain OUTPUT (policy ACCEPT 7747 packets, 431K bytes)

 pkts bytes target     prot opt in     out     source               destination

```

cat /proc/sys/net/ipv4/ip_forward:

```

1

```

ifconfig:

```

eth0      Link encap:Ethernet  HWaddr 00:13:D4:7C:F8:D4

          inet addr:192.168.1.100  Bcast:192.168.1.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:155628 errors:0 dropped:0 overruns:0 frame:0

          TX packets:105311 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:195661995 (186.5 Mb)  TX bytes:13185513 (12.5 Mb)

          Interrupt:16

eth1      Link encap:Ethernet  HWaddr 00:80:AD:74:15:C3

          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0

          UP BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:12694 errors:6534 dropped:0 overruns:0 frame:0

          TX packets:5 errors:1 dropped:0 overruns:0 carrier:1

          collisions:0 txqueuelen:1000

          RX bytes:808309 (789.3 Kb)  TX bytes:416 (416.0 b)

          Interrupt:17 Base address:0xe000

lo        Link encap:Local Loopback

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:3373 errors:0 dropped:0 overruns:0 frame:0

          TX packets:3373 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0

          RX bytes:142366 (139.0 Kb)  TX bytes:142366 (139.0 Kb)

ppp0      Link encap:Point-to-Point Protocol

          inet addr:210.213.240.208  P-t-P:210.213.240.1  Mask:255.255.255.255

          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1

          RX packets:154845 errors:0 dropped:0 overruns:0 frame:0

          TX packets:104503 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:3

          RX bytes:191585799 (182.7 Mb)  TX bytes:10415262 (9.9 Mb)

```

route -n:

```

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

210.213.240.1   0.0.0.0         255.255.255.255 UH    0      0        0 ppp0

192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

0.0.0.0         210.213.240.1   0.0.0.0         UG    0      0        0 ppp0

```

ping 192.168.0.2 (CTRL+C):

```

PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.

--- 192.168.0.2 ping statistics ---

11 packets transmitted, 0 received, 100% packet loss, time 10066ms

```

Sorry if my reply was late, I had issues with my desktop system (kde "konked" out by getting rid of my window borders and decorations, hence I'm using gnome right now).

--trigger-happy

----------

## trigger-happy

Hello?...someone help...please... My sister doesn't like the idea of having no internet whenever i'm in linux at all so please have a heart and save me from the chain saw ;_;

No really..I need to get this worked out before she starts acting like a complete brat and ask my mom to force me to go stick with windows forever...

--trigger-happy

----------

