Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #179556 > unrolled thread

Wan/Lan problem

Back to article view | Back to linux.debian.user

Contents

  Wan/Lan problem Mike McClain <mike.junk.46@copper.net> - 2017-03-29 03:20 +0200
    Re: Wan/Lan problem Dan Ritter <dsr@randomstring.org> - 2017-03-29 04:20 +0200
      Re: Wan/Lan problem Mike McClain <mike.junk.46@copper.net> - 2017-03-29 18:10 +0200
        Re: Wan/Lan problem Joshua Schaeffer <jschaeffer0922@gmail.com> - 2017-03-29 20:50 +0200
        Re: Wan/Lan problem David Christensen <dpchrist@holgerdanske.com> - 2017-03-29 21:20 +0200
        Re: Wan/Lan problem <tomas@tuxteam.de> - 2017-03-29 21:50 +0200
    Re: Wan/Lan problem David Christensen <dpchrist@holgerdanske.com> - 2017-03-29 09:20 +0200
      Re: Wan/Lan problem rhkramer@gmail.com - 2017-03-29 15:00 +0200
        Re: Wan/Lan problem Mike McClain <mike.junk.46@copper.net> - 2017-03-29 23:30 +0200
          Re: Wan/Lan problem rhkramer@gmail.com - 2017-03-30 15:50 +0200
    Re: Wan/Lan problem <tomas@tuxteam.de> - 2017-03-29 11:50 +0200
    Re: Wan/Lan problem kAt <giathnygeia@openmailbox.org> - 2017-03-29 23:10 +0200
    Re: Wan/Lan problem Henning Follmann <hfollmann@itcfollmann.com> - 2017-03-30 13:30 +0200
      Re: Wan/Lan problem Mike McClain <mike.junk.46@copper.net> - 2017-03-31 02:50 +0200
        Re: Wan/Lan problem Henning Follmann <hfollmann@itcfollmann.com> - 2017-03-31 03:50 +0200
          Re: Wan/Lan problem [SOLVED] Mike McClain <mike.junk.46@copper.net> - 2017-03-31 23:10 +0200

#179556 — Wan/Lan problem

Howdy,
I have a WAN/LAN challenge I'm hoping for help with.

I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.

mike@/deb7:~> uname -a
Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux


The situation is this:

     phone        eth0         eth1
AT&T-------|   |--------|   |--------|   |-------|   |
        AT&T modem/     Linux         my         Win2K
            router       box         router       box

When eth0 is up and eth1 down,
                    the Linux box can access the web.
                    'ping ATTrouter' works.
When eth0 is up and eth1 up,
                    the Linux box can not access the web.
                    the Win2K box can access the web.
                    the Linux box can not access the Win2K shares.
                    'ping ATTrouter' fails.
                    'ping -Ieth0 ATTrouter' works.
When eth0 is down and eth1 up,
                    the Linux box can access the Win2K shares.
When eth0 is down and eth1 down,
                    it's quiet.

The ATT router is set to 'Pass Through' giving the Linux box the ATT
router's IP address.
The Linux box is set to use DHCP.
This might explain why I loose the LAN connection when eth0 up.

Why can the Linux box not see the web while the Win2K box can?

I've not found or at least recognized the problem in the HowTo's.
Pointer's or suggestions?

Thanks,
Mike

#   /etc/hosts
192.168.1.254    ATTrouter
#192.168.1.64    outbound.att.net    att
127.0.0.1       localhost
192.168.1.2     playground      play
192.168.1.3     south40         s40
192.168.1.1     router
# ----------------------- end hosts

# /etc/networks
default		0.0.0.0
loopback	127.0.0.0
link-local	169.254.0.0
localnet	192.168.1.0
# ----------------------- end networks

# /etc/resolv.conf
domain attlocal.net
search attlocal.net
nameserver 192.168.1.254
# ----------------------- end resolv.conf

#   /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth1
#   eth0 = onboard eth port
iface eth0 inet dhcp
#   eth1 = 3Com PCI 3c905C card
iface eth1 inet static
        address 192.168.1.2
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 208.67.222.222 208.67.220.220
# ----------------------- end interfaces

--
"I reckon some folks figure it a compliment to be called 'broad-minded.'
Back home, broad-minded is just another way of saying a feller is too
lazy to form an opinion."    - Will Rogers

[toc] | [next] | [standalone]

#179558

On Tue, Mar 28, 2017 at 04:46:02PM -0700, Mike McClain wrote:
> Howdy,
> I have a WAN/LAN challenge I'm hoping for help with.
> 
> I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.
> 
> mike@/deb7:~> uname -a
> Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux
> 
> 
> The situation is this:
> 
>      phone        eth0         eth1
> AT&T-------|   |--------|   |--------|   |-------|   |
>         AT&T modem/     Linux         my         Win2K
>             router       box         router       box
> 
> When eth0 is up and eth1 down,
>                     the Linux box can access the web.
>                     'ping ATTrouter' works.
> When eth0 is up and eth1 up,
>                     the Linux box can not access the web.
>                     the Win2K box can access the web.
>                     the Linux box can not access the Win2K shares.
>                     'ping ATTrouter' fails.
>                     'ping -Ieth0 ATTrouter' works.
> When eth0 is down and eth1 up,
>                     the Linux box can access the Win2K shares.
> When eth0 is down and eth1 down,
>                     it's quiet.
> 
> The ATT router is set to 'Pass Through' giving the Linux box the ATT
> router's IP address.
> The Linux box is set to use DHCP.
> This might explain why I loose the LAN connection when eth0 up.
> 
> Why can the Linux box not see the web while the Win2K box can?
> 
> I've not found or at least recognized the problem in the HowTo's.
> Pointer's or suggestions?
> 
> Thanks,
> Mike
> 
> 
> # The loopback network interface
> auto lo
> iface lo inet loopback
> 
> # The primary network interface
> allow-hotplug eth1
> #   eth0 = onboard eth port
> iface eth0 inet dhcp
> #   eth1 = 3Com PCI 3c905C card
> iface eth1 inet static
>         address 192.168.1.2
>         netmask 255.255.255.0
>         network 192.168.1.0
>         broadcast 192.168.1.255
>         # dns-* options are implemented by the resolvconf package, if installed
>         dns-nameservers 208.67.222.222 208.67.220.220

You're going to end up discovering that this is a problem in IP
assignment, routing, forwarding, or something very similar.

What masquerading are you doing? What IP forwarding? What
routing entries are present?

-dsr-

[toc] | [prev] | [next] | [standalone]

#179578

On Tue, Mar 28, 2017 at 10:14:50PM -0400, Dan Ritter wrote:
> On Tue, Mar 28, 2017 at 04:46:02PM -0700, Mike McClain wrote:
<snip>
> > The situation is this:
> >
> >      phone        eth0         eth1
> > AT&T-------|   |--------|   |--------|   |-------|   |
> >         AT&T modem/     Linux         my         Win2K
> >             router       box         router       box
> >
> > When eth0 is up and eth1 down,
> >                     the Linux box can access the web.
> >                     'ping ATTrouter' works.
> > When eth0 is up and eth1 up,
> >                     the Linux box can not access the web.
> >                     the Win2K box can access the web.
> >                     the Linux box can not access the Win2K shares.
> >                     'ping ATTrouter' fails.
> >                     'ping -Ieth0 ATTrouter' works.
> > When eth0 is down and eth1 up,
> >                     the Linux box can access the Win2K shares.
> > When eth0 is down and eth1 down,
> >                     it's quiet.
> >
> > The ATT router is set to 'Pass Through' giving the Linux box the ATT
> > router's IP address.
> > The Linux box is set to use DHCP.
> > This might explain why I loose the LAN connection when eth0 up.
> >
> > Why can the Linux box not see the web while the Win2K box can?
>
> You're going to end up discovering that this is a problem in IP
> assignment, routing, forwarding, or something very similar.
>
> What masquerading are you doing? What IP forwarding? What
> routing entries are present?
>
> -dsr-

Here are the statements from the firewall on the Linux box
that deal with the LAN:

INET=eth0;
LAN=eth1;
S40='192.168.1.3';      # static IP of Win2K box

#   for masq    allow forwarding
fwd=1;
echo $fwd > /proc/sys/net/ipv4/ip_forward
echo $fwd > /proc/sys/net/ipv4/conf/all/forwarding
echo $fwd > /proc/sys/net/ipv4/conf/default/forwarding
echo $fwd > /proc/sys/net/ipv4/conf/lo/forwarding
echo $fwd > /proc/sys/net/ipv4/conf/eth0/forwarding
echo $fwd > /proc/sys/net/ipv4/conf/eth1/forwarding

iptables -A INPUT -i $LAN -j ACCEPT
iptables -A OUTPUT -f -d $S40 -j DROP
iptables -A FORWARD -i $LAN -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o $INET -j MASQUERADE

eth0 up, eth1 down
root@/deb73:~> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         99.188.244.1    0.0.0.0         UG    0      0        0 eth0
99.188.244.0    0.0.0.0         255.255.252.0   U     0      0        0 eth0

eth0 up, eth1 up
root@/deb73:~> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         99.188.244.1    0.0.0.0         UG    0      0        0 eth0
99.188.244.0    0.0.0.0         255.255.252.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

eth0 down, eth1 up
root@/deb73:~> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

The Linux box is my main computer, it's just a computer but runs my firewall.

My router is NetGear RP614 and all connections to the router are on the lan
side, nothing in the i'net port. Just the 2 computers and the printer.

The Win2K box is just a computer but has my music and financials.
Each box serves as backup storage for the other.

No Wi-Fi, pods, phones, tablets, game consoles, laptops, etc.

Any other thoughts/suggestions?

Thanks to Dan, David & Tomas for the help.

Mike
--
You buy the votes you need. Political power flows from money,
it always has; the concept of society is about money.
    - Nancy Kress in 'Beggers in Spain'

[toc] | [prev] | [next] | [standalone]

#179582

[Multipart message — attachments visible in raw view] — view raw

I'm going to join the fray and take a crack at this. I'll try to help as
best I can to resolve the situation in your current setup, but I would like
to say that I agree with what others have posted and would say that this is
a little (but not too much) unorthodox. Typically desktop, server,
application, and personal machines are put behind the router in the IPv4
paradigm. We then use NATing to allow multiple machines onto the interwebs.
However I only say it is somewhat unorthodox, as dedicated network
equipment is often given external IP addresses. It just look like you are
using your Linux box as network equipment and as a personal machine.

I'm going to focus on questions concerning when both NIC's are up, seeing
as this is probably the desired end result.


On Wed, Mar 29, 2017 at 9:51 AM, Mike McClain <mike.junk.46@copper.net>
wrote:

>
> > > When eth0 is up and eth1 up,
> > >                     the Linux box can not access the web.
> > >                     the Win2K box can access the web.
> > >                     the Linux box can not access the Win2K shares.
> > >                     'ping ATTrouter' fails.
> > >                     'ping -Ieth0 ATTrouter' works.
>
>
   1. What does a traceroute show on the Windows box?
   2. What does a tcpdump or wireshark output of a ping to 99.188.244.1
   show on both Linux and Windows?
   3. What happens when you remove the 192.168.1/24 route? Does the Linux
   box then have internet access? Does the Windows box lose internet access?
   4. A quick way to start to narrow down where the problem or problems
   exist is to completely disable your firewall and perform your tests again.
   If any of them succeed then you know it has something to do with netfilter.

I'll try to look at your config more and see if I can spot anything in
particular.

Thanks,
Joshua Schaeffer

[toc] | [prev] | [next] | [standalone]

#179583

On 03/29/2017 08:51 AM, Mike McClain wrote:
> On Tue, Mar 28, 2017 at 10:14:50PM -0400, Dan Ritter wrote:
>> On Tue, Mar 28, 2017 at 04:46:02PM -0700, Mike McClain wrote:
>>>
>>> I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram. ...
>>>
>>> phone        eth0         eth1 AT&T-------|   |--------|
>>> |--------|   |-------|   | AT&T modem/     Linux         my Win2K
>>> router       box         router       box
>
> The Linux box is my main computer, it's just a computer but runs my
> firewall.
>
> My router is NetGear RP614 and all connections to the router are on
> the lan side, nothing in the i'net port. Just the 2 computers and
> the printer.
>
> The Win2K box is just a computer but has my music and financials.
> Each box serves as backup storage for the other.
>
> No Wi-Fi, pods, phones, tablets, game consoles, laptops, etc.
>
> Any other thoughts/suggestions?

Any device with multiple network interfaces and that passes packets
between them is functioning as a router.


It is unwise to use one device as both a firewall/router and as
anything else -- especially a workstation/desktop (that's where the
intruders like to break in).


Regarding the Netgear RP614 router, which one?

https://www.netgear.com/support/product/RP614v1

https://www.netgear.com/support/product/RP614v2

https://www.netgear.com/support/product/RP614v3

https://www.netgear.com/support/product/RP614v4


I have the same recommendation as rhkramer:

On 03/29/2017 05:50 AM, rhkramer wrote:
> Put your router immediately after the AT&T modem, then (assuming
> there are multiple ethernet ports on the router), put your Linux box
> on one eth port and the Windows box on another.  (That would require
> 3 ports on the router.)

Plus:

1.  Connect the RP614 WAN port to the modem.  The RP614 has 4 LAN ports; 
connect two of these to the Linux box and to the printer.

2.  Check the version of the firmware in the Netgear RP614.  Download
and install current firmware if needed.  Also, check if there are known 
vulnerabilities.  (I doubt open-source firmware is available, as the 
RP614 does not have a Wi-Fi interface, but it might be worth some 
searching.)

3.  Win2K is unsupported.  Therefore, it must be treated as insecure and
should not have access to your LAN or to the Internet.  Options include:

     a.  Unplug the network cable ("air wall").  This means putting
backups on an external drive.

     b.  Check if your hardware, music apps, and financial apps are 
supported by Windows 7.  If so, upgrade and connect to a free LAN port 
on the RP614.

     c.  Migrate your music and financial apps to the Linux box and 
retire the machine.

4.  For backups, I prefer a dedicated machine that pulls files over ssh
and is firewalled to block all incoming ports.  (I need to research 
firewalling outgoing ports as well.)  If/when an intruder breaks into 
any/all of the other hosts, hopefully I will figure it out before he 
gets into the backup server.

5.  There is a saying, "don't throw good money after bad".  My guess is 
that your Win2K machine is also outdated hardware.  My P3 computers went 
to curb-side recycling years ago.  I'm trying to squeeze a little more 
life out of my high-end P4's, but they will follow sooner or later.  I'd 
suggest getting newer hardware and migrating all your apps and data onto 
that.  Older machines can be useful as firewall/router appliances (e.g. 
http://www.ipcop.org/), backup appliances, and spare/ workbench/ 
experimental/ etc. machines.


> Thanks to Dan, David & Tomas for the help.

YW.  Please let us know how it goes.


David

[toc] | [prev] | [next] | [standalone]

#179584

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 29, 2017 at 08:51:58AM -0700, Mike McClain wrote:
> On Tue, Mar 28, 2017 at 10:14:50PM -0400, Dan Ritter wrote:
> > On Tue, Mar 28, 2017 at 04:46:02PM -0700, Mike McClain wrote:
> <snip>
> > > The situation is this:
> > >
> > >      phone        eth0         eth1
> > > AT&T-------|   |--------|   |--------|   |-------|   |
> > >         AT&T modem/     Linux         my         Win2K
> > >             router       box         router       box

[...]

> Here are the statements from the firewall on the Linux box
> that deal with the LAN:
> 
> INET=eth0;
> LAN=eth1;
> S40='192.168.1.3';      # static IP of Win2K box
> 
> #   for masq    allow forwarding
> fwd=1;
> echo $fwd > /proc/sys/net/ipv4/ip_forward
> echo $fwd > /proc/sys/net/ipv4/conf/all/forwarding
> echo $fwd > /proc/sys/net/ipv4/conf/default/forwarding
> echo $fwd > /proc/sys/net/ipv4/conf/lo/forwarding
> echo $fwd > /proc/sys/net/ipv4/conf/eth0/forwarding
> echo $fwd > /proc/sys/net/ipv4/conf/eth1/forwarding
> 
> iptables -A INPUT -i $LAN -j ACCEPT
> iptables -A OUTPUT -f -d $S40 -j DROP

The above looks suspect: packets leaving your Linux box towards your
Windows box are dropped? Perhaps I'm missing something.

> iptables -A FORWARD -i $LAN -j ACCEPT
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -t nat -A POSTROUTING -o $INET -j MASQUERADE
> 
> eth0 up, eth1 down
> root@/deb73:~> route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 0.0.0.0         99.188.244.1    0.0.0.0         UG    0      0        0 eth0
> 99.188.244.0    0.0.0.0         255.255.252.0   U     0      0        0 eth0

OK.

> eth0 up, eth1 up
> root@/deb73:~> route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 0.0.0.0         99.188.244.1    0.0.0.0         UG    0      0        0 eth0
> 99.188.244.0    0.0.0.0         255.255.252.0   U     0      0        0 eth0
> 192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

This looks sensible, too.

> eth0 down, eth1 up
> root@/deb73:~> route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

and this.

Hmmm. The routing tables look sane to me. At the moment I have no explanation
why the Linux box can't "see" the Internet while the net to the Windows box
is up. Can you ping the AT&T router? When the Windows net is up/is down?

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAljcDbcACgkQBcgs9XrR2kaEBQCeLofOgV12Z6nMGqsyp6uFA3Rm
Oi0AniEW1OQHJalIm2tvQXA/3OyVb1ij
=jxTG
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#179563

On 03/28/2017 04:46 PM, Mike McClain wrote:
> Howdy,
> I have a WAN/LAN challenge I'm hoping for help with.
>
> I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.
>
> mike@/deb7:~> uname -a
> Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux
>
>
> The situation is this:
>
>      phone        eth0         eth1
> AT&T-------|   |--------|   |--------|   |-------|   |
>         AT&T modem/     Linux         my         Win2K
>             router       box         router       box
>
> When eth0 is up and eth1 down,
>                     the Linux box can access the web.
>                     'ping ATTrouter' works.
> When eth0 is up and eth1 up,
>                     the Linux box can not access the web.
>                     the Win2K box can access the web.
>                     the Linux box can not access the Win2K shares.
>                     'ping ATTrouter' fails.
>                     'ping -Ieth0 ATTrouter' works.
> When eth0 is down and eth1 up,
>                     the Linux box can access the Win2K shares.
> When eth0 is down and eth1 down,
>                     it's quiet.
>
> The ATT router is set to 'Pass Through' giving the Linux box the ATT
> router's IP address.
> The Linux box is set to use DHCP.
> This might explain why I loose the LAN connection when eth0 up.
>
> Why can the Linux box not see the web while the Win2K box can?
>
> I've not found or at least recognized the problem in the HowTo's.
> Pointer's or suggestions?
>
> Thanks,
> Mike
>
> #   /etc/hosts
> 192.168.1.254    ATTrouter
> #192.168.1.64    outbound.att.net    att
> 127.0.0.1       localhost
> 192.168.1.2     playground      play
> 192.168.1.3     south40         s40
> 192.168.1.1     router
> # ----------------------- end hosts
>
> # /etc/networks
> default		0.0.0.0
> loopback	127.0.0.0
> link-local	169.254.0.0
> localnet	192.168.1.0
> # ----------------------- end networks
>
> # /etc/resolv.conf
> domain attlocal.net
> search attlocal.net
> nameserver 192.168.1.254
> # ----------------------- end resolv.conf
>
> #   /etc/network/interfaces
> # This file describes the network interfaces available on your system
> # and how to activate them. For more information, see interfaces(5).
>
> # The loopback network interface
> auto lo
> iface lo inet loopback
>
> # The primary network interface
> allow-hotplug eth1
> #   eth0 = onboard eth port
> iface eth0 inet dhcp
> #   eth1 = 3Com PCI 3c905C card
> iface eth1 inet static
>         address 192.168.1.2
>         netmask 255.255.255.0
>         network 192.168.1.0
>         broadcast 192.168.1.255
>         # dns-* options are implemented by the resolvconf package, if installed
>         dns-nameservers 208.67.222.222 208.67.220.220
> # ----------------------- end interfaces

1.  What is the purpose of "Linux box"?

2.  What is the make and model of "my router"?  What is its purpose? 
What port is the "Linux box" connected to?  What port is the "Win2K box" 
connected to?

3.  What is the purpose of "Win2K box"?

4.  Are there any other devices or hosts, such as a Wi-Fi access point, 
Wi-Fi interface in "my router", pods, phones, tablets, game consoles, 
laptops, etc.?


David

[toc] | [prev] | [next] | [standalone]

#179573

On Wednesday, March 29, 2017 03:17:37 AM David Christensen wrote:
> On 03/28/2017 04:46 PM, Mike McClain wrote:
> > Howdy,
> > I have a WAN/LAN challenge I'm hoping for help with.
> > 
> > I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.
> > 
> > mike@/deb7:~> uname -a
> > Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux
> > 
> > The situation is this:
> >      phone        eth0         eth1
> > 
> > AT&T-------|   |--------|   |--------|   |-------|   |
> > 
> >         AT&T modem/     Linux         my         Win2K
> >         
> >             router       box         router       box

I apologize because this doesn't answer your question but proposes an 
alternative arrangment that, I believe, would be easier to configure.

I don't know the physical arrangement of your devices (in your home or office), 
but my arrangement (and most arrangements I've seen) are a little different and 
maybe you want to try an arrangment more like this:

Put your router immediately after the AT&T modem, then (assuming there are 
multiple ethernet ports on the router), put your Linux box on one eth port and 
the Windows box on another.  (That would require 3 ports on the router.)

If you don't have 3 ports on the router, consider getting a switch to place 
after the router, and put the Linux and Windows boxes on 2 separate outputs 
from the switch.

Either of these is a much more standard arrangement, and I have very little 
trouble with any of this.  (The troubles I have had are not relevant to the 
arrangement--things like Earthlink / Verizon outages and dealing with their 
customer non-support, an anomaly in how a Westell modem worked (now using a 
ZyXel), and difficulties in understanding and configuring QOS (primarily for 
VOIP).)

[toc] | [prev] | [next] | [standalone]

#179591

On Wed, Mar 29, 2017 at 08:50:15AM -0400, rhkramer@gmail.com wrote:
> On Wednesday, March 29, 2017 03:17:37 AM David Christensen wrote:
> > On 03/28/2017 04:46 PM, Mike McClain wrote:
<snip>
> > >      phone        eth0         eth1
> > >
> > > AT&T-------|   |--------|   |--------|   |-------|   |
> > >
> > >         AT&T modem/     Linux         my         Win2K
> > >
> > >             router       box         router       box
>
<snip>
> Put your router immediately after the AT&T modem, then (assuming there are
> multiple ethernet ports on the router), put your Linux box on one eth port and
> the Windows box on another.  (That would require 3 ports on the router.)
<snip>

The problem I have with your solution is that the Win2K box is not
behind the firewall I have running on the Linux box.

Thank you for your thoughts.
Mike
--
You buy the votes you need. Political power flows from money,
it always has; the concept of society is about money.
    - Nancy Kress in 'Beggers in Spain'

[toc] | [prev] | [next] | [standalone]

#179598

On Wednesday, March 29, 2017 05:11:25 PM Mike McClain wrote:
> The problem I have with your solution is that the Win2K box is not
> behind the firewall I have running on the Linux box.
> 
> Thank you for your thoughts.

You're welcome!

I think Henning, in a later post, may have identified the problem in your 
configuration.

Still for posterity, I'll mention a few things:

   * I don't know what you have in your firewall, but I think (but am not sure) 
that most routers can do firewalls

   * And a router like the EdgeRouter from Unity has an underlying (and 
accessible) Debian OS (6.n) so maybe your firewall rules could be moved there.  

   * I don't use firewalls, I use NAT (which has a few variations) and an 
/etc/hosts files which basically ignores a large number of spammy websites (by 
resolving the host name to 0.0.0.0).

Good luck, I hope Henniing has identified the problem! 

[toc] | [prev] | [next] | [standalone]

#179569

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Mar 28, 2017 at 04:46:02PM -0700, Mike McClain wrote:
> Howdy,
> I have a WAN/LAN challenge I'm hoping for help with.
> 
> I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.
> 
> mike@/deb7:~> uname -a
> Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux
> 
> 
> The situation is this:
> 
>      phone        eth0         eth1
> AT&T-------|   |--------|   |--------|   |-------|   |
>         AT&T modem/     Linux         my         Win2K
>             router       box         router       box
> 
> When eth0 is up and eth1 down,
>                     the Linux box can access the web.
>                     'ping ATTrouter' works.
> When eth0 is up and eth1 up,
>                     the Linux box can not access the web.
>                     the Win2K box can access the web.
>                     the Linux box can not access the Win2K shares.
>                     'ping ATTrouter' fails.
>                     'ping -Ieth0 ATTrouter' works.

To repeat what Dan said with slightly different wording... check
your routing here:

  /sbin/route -n

(and check that above, "when eth0 is up and eth1 is down").

I'll bet that the "Linux box" default route has moved from
"AT&T modem/router" to "my router", and now things that the
InterTubes are now to be found that way.

(I skip the rest for when we have some more light on the
above part -- bumping one's head on a Gateway Goblin is no
fun ;-)

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAljbgYMACgkQBcgs9XrR2kaSNwCdHsBY1kNplnCo/Npr3wjdg43Y
SYEAnjfcYe+dUt+uRui6Y7RxQRjAhxMG
=N+Fp
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#179590

Is ipv6 on/off/capable on this system?

Mike McClain:
> Howdy,
> I have a WAN/LAN challenge I'm hoping for help with.
> 

[toc] | [prev] | [next] | [standalone]

#179597

On March 28, 2017 7:46:02 PM EDT, Mike McClain <mike.junk.46@copper.net> wrote:
>Howdy,
>I have a WAN/LAN challenge I'm hoping for help with.
>
>I'm runniing Debian 7.11 on a Pentium 3 with 250MB ram.
>
>mike@/deb7:~> uname -a
>Linux playground 3.2.0-4-686-pae #1 SMP Debian 3.2.84-2 i686 GNU/Linux
>
>
>The situation is this:
>
>     phone        eth0         eth1
>AT&T-------|   |--------|   |--------|   |-------|   |
>        AT&T modem/     Linux         my         Win2K
>            router       box         router       box
>
>When eth0 is up and eth1 down,
>                    the Linux box can access the web.
>                    'ping ATTrouter' works.
>When eth0 is up and eth1 up,
>                    the Linux box can not access the web.
>                    the Win2K box can access the web.
>                    the Linux box can not access the Win2K shares.
>                    'ping ATTrouter' fails.
>                    'ping -Ieth0 ATTrouter' works.
>When eth0 is down and eth1 up,
>                    the Linux box can access the Win2K shares.
>When eth0 is down and eth1 down,
>                    it's quiet.
>
>The ATT router is set to 'Pass Through' giving the Linux box the ATT
>router's IP address.
>The Linux box is set to use DHCP.
>This might explain why I loose the LAN connection when eth0 up.
>
>Why can the Linux box not see the web while the Win2K box can?
>
>I've not found or at least recognized the problem in the HowTo's.
>Pointer's or suggestions?
>
>Thanks,
>Mike
>
>#   /etc/hosts
>192.168.1.254    ATTrouter
>#192.168.1.64    outbound.att.net    att
>127.0.0.1       localhost
>192.168.1.2     playground      play
>192.168.1.3     south40         s40
>192.168.1.1     router
># ----------------------- end hosts
>
># /etc/networks
>default		0.0.0.0
>loopback	127.0.0.0
>link-local	169.254.0.0
>localnet	192.168.1.0
># ----------------------- end networks
>
># /etc/resolv.conf
>domain attlocal.net
>search attlocal.net
>nameserver 192.168.1.254
># ----------------------- end resolv.conf
>
>#   /etc/network/interfaces
># This file describes the network interfaces available on your system
># and how to activate them. For more information, see interfaces(5).
>
># The loopback network interface
>auto lo
>iface lo inet loopback
>
># The primary network interface
>allow-hotplug eth1
>#   eth0 = onboard eth port
>iface eth0 inet dhcp
>#   eth1 = 3Com PCI 3c905C card
>iface eth1 inet static
>        address 192.168.1.2
>        netmask 255.255.255.0
>        network 192.168.1.0
>        broadcast 192.168.1.255
># dns-* options are implemented by the resolvconf package, if installed
>        dns-nameservers 208.67.222.222 208.67.220.220
># ----------------------- end interfaces
>
>--
>"I reckon some folks figure it a compliment to be called
>'broad-minded.'
>Back home, broad-minded is just another way of saying a feller is too
>lazy to form an opinion."    - Will Rogers



You put eth0 and eth1 into the same network segment.
That most likely is your problem
Either you bridge eth0 and eth1 or if you want your linux box as a firewall you pick a different ntwork for eth1

-- 
Henning Follmann

[toc] | [prev] | [next] | [standalone]

#179624

On Thu, Mar 30, 2017 at 07:25:52AM -0400, Henning Follmann wrote:
> On March 28, 2017 7:46:02 PM EDT, Mike McClain <mike.junk.46@copper.net> wrote:
<snip>
> >The situation is this:
> >
> >     phone        eth0         eth1
> >AT&T-------|   |--------|   |--------|   |-------|   |
> >        AT&T modem/     Linux         my         Win2K
> >            router       box         router       box
> >
> >
> >#   /etc/hosts
> >192.168.1.254    ATTrouter
> >#192.168.1.64    outbound.att.net    att
> >127.0.0.1       localhost
> >192.168.1.2     playground      play
> >192.168.1.3     south40         s40
> >192.168.1.1     router
> ># ----------------------- end hosts
>
> You put eth0 and eth1 into the same network segment.
> That most likely is your problem
> Either you bridge eth0 and eth1 or if you want your linux box as a firewall you pick a different ntwork for eth1
>
> --
> Henning Follmann

If I'm understanding you you're saying that ATT's router having an
address of 192.168.1.254 on eth0 while the Linux box(play), Win2k(s40)
and my router have addresses 192.168.1.1,2&3 on eth1 is the root of
the problem. Since ATT's router's address is immutable I either need
to reconfigure 2 computers and a router to a different net,
192.168.2.0 or 10.0.0.0, for instance or learn to build bridges.

Is my understanding correct?

Thanks,
Mike
--
Goodness will be rewarded with goodness.
    - Chinese proverb

[toc] | [prev] | [next] | [standalone]

#179625

On March 30, 2017 8:27:54 PM EDT, Mike McClain <mike.junk.46@copper.net> wrote:
>On Thu, Mar 30, 2017 at 07:25:52AM -0400, Henning Follmann wrote:
>> On March 28, 2017 7:46:02 PM EDT, Mike McClain
><mike.junk.46@copper.net> wrote:
><snip>
>> >The situation is this:
>> >
>> >     phone        eth0         eth1
>> >AT&T-------|   |--------|   |--------|   |-------|   |
>> >        AT&T modem/     Linux         my         Win2K
>> >            router       box         router       box
>> >
>> >
>> >#   /etc/hosts
>> >192.168.1.254    ATTrouter
>> >#192.168.1.64    outbound.att.net    att
>> >127.0.0.1       localhost
>> >192.168.1.2     playground      play
>> >192.168.1.3     south40         s40
>> >192.168.1.1     router
>> ># ----------------------- end hosts
>>
>> You put eth0 and eth1 into the same network segment.
>> That most likely is your problem
>> Either you bridge eth0 and eth1 or if you want your linux box as a
>firewall you pick a different ntwork for eth1
>>
>> --
>> Henning Follmann
>
>If I'm understanding you you're saying that ATT's router having an
>address of 192.168.1.254 on eth0 while the Linux box(play), Win2k(s40)
>and my router have addresses 192.168.1.1,2&3 on eth1 is the root of
>the problem. Since ATT's router's address is immutable I either need
>to reconfigure 2 computers and a router to a different net,
>192.168.2.0 or 10.0.0.0, for instance or learn to build bridges.
>
>Is my understanding correct?
>
>Thanks,
>Mike


Yes,
with your configuration both eth0 and eth1 are in 192.168.1.0/24. There is no way tobfigure out which to use.

However you have to provide more than just diferent subnets. The network behind the firewall now needs dns and most likely also dhcp.
You could install dnsmasq. It provides just this.

However based on your initial understanding of networking I wonder if something like pfsense makes more sense for you.


Another way to set this up would be a transparent firewall. In that case you bridge eth0 and eth1 without assigning an ip address at all. You might want to have athird network interface for maintenance tho.
Pfsense also privides that functionality.


-H

-- 
Henning Follmann

[toc] | [prev] | [next] | [standalone]

#179664 — Re: Wan/Lan problem [SOLVED]

On Thu, Mar 30, 2017 at 09:40:29PM -0400, Henning Follmann wrote:
> On March 30, 2017 8:27:54 PM EDT, Mike McClain <mike.junk.46@copper.net> wrote:
> >On Thu, Mar 30, 2017 at 07:25:52AM -0400, Henning Follmann wrote:
> >> On March 28, 2017 7:46:02 PM EDT, Mike McClain
> ><mike.junk.46@copper.net> wrote:
> ><snip>
> >If I'm understanding you you're saying that ATT's router having an
> >address of 192.168.1.254 on eth0 while the Linux box(play), Win2k(s40)
> >and my router have addresses 192.168.1.1,2&3 on eth1 is the root of
> >the problem. Since ATT's router's address is immutable I either need
> >to reconfigure 2 computers and a router to a different net,
> >192.168.2.0 or 10.0.0.0, for instance or learn to build bridges.
> >
> >Is my understanding correct?
> >
> >Thanks,
> >Mike
>
>
> Yes,
> with your configuration both eth0 and eth1 are in 192.168.1.0/24. There is no way tobfigure out which to use.
>
> However you have to provide more than just diferent subnets. The network behind the firewall now needs dns and most likely also dhcp.
> You could install dnsmasq. It provides just this.
>
> However based on your initial understanding of networking I wonder if something like pfsense makes more sense for you.
>
> Another way to set this up would be a transparent firewall. In that case you bridge eth0 and eth1 without assigning an ip address at all. You might want to have athird network interface for maintenance tho.
> Pfsense also privides that functionality.
>

    My thanks to Mr. Follmann and all you others that helped.
As it turned out ATT's router having an address of 192.168.1.254 is
not immutable but subject to change by the user(me). Setting ATT's
router to 192.168.2.254 solved all my problems. With eth0 and eth1
both up, the  Linux box and the Win2K box can both browse the i'net
passing GRC.com's all ports scan and I can still mount the Win2K
shared partitions from Linux.
    An extra thanks to you, Henning for pointing out the trouble spot.

Mike
--
People ain't any more interested in politics than they are in long
underwear. Both sides have lied to 'em so often that we don't look on
any candidate with admiration or with hate; we just pity 'em.
    - Will Rogers

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web