From owner-freebsd-questions@FreeBSD.ORG Sat May 19 22:01:35 2012 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DD9011065672 for ; Sat, 19 May 2012 22:01:34 +0000 (UTC) (envelope-from derek@computinginnovations.com) Received: from betty.computinginnovations.com (mail.computinginnovations.com [64.81.227.250]) by mx1.freebsd.org (Postfix) with ESMTP id 4E3C78FC17 for ; Sat, 19 May 2012 22:01:34 +0000 (UTC) Received: from i7-quad-PC.computinginnovations.com (dhcp-10-20-30-142.computinginnovations.com [10.20.30.142]) by betty.computinginnovations.com (8.14.5/8.14.3) with ESMTP id q4JM060T008462; Sat, 19 May 2012 17:00:07 -0500 (CDT) (envelope-from derek@computinginnovations.com) Message-Id: <6.0.0.22.2.20120519165616.058306c0@mail.computinginnovations.com> X-Sender: derek@mail.computinginnovations.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.22 Date: Sat, 19 May 2012 16:59:52 -0500 To: David Banning , Chuck Swiger From: Derek Ragona In-Reply-To: <20120518120716.GA28838@skytracker.ca> References: <20120516200837.GA63280@skytracker.ca> <70BC5C41-FD4F-4B57-86F8-8C48BA075EC1@mac.com> <20120518120716.GA28838@skytracker.ca> Mime-Version: 1.0 X-Antivirus: avast! (VPS 120519-0, 05/19/2012), Outbound message X-Antivirus-Status: Clean X-yoursite-MailScanner-Information: Please contact the ISP for more information X-yoursite-MailScanner-ID: q4JM060T008462 X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: derek@computinginnovations.com X-Spam-Status: No Content-Type: text/plain; charset="us-ascii"; format=flowed X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: questions@freebsd.org Subject: Re: problems with networking and route command X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 May 2012 22:01:35 -0000 At 07:07 AM 5/18/2012, David Banning wrote: > > > It is machines that connect and receive via DHCP 192.168.1.2 and > above that > > > can't connect to the internet though the server. I don't know a whole > > > lot about route - I have been attempting a variation of route commands > > > without success. > > > > You need to implement NAT on this box, since 192.168.0.0/16 is an > RFC-1918 unrouteable private network range. > >I previously connected to the internet using ppp with the -nat option >and now my connection has changed - so that makes sense. > >So I implemented natd. > >Unfortunately natd does not work as yet. I followed the setup as laid >out in "man natd" and also used the layout in; > >http://www.freebsddiary.org/ipfw.php > >Here is my natd setup > >1. Compiled IPFIREWALL & IPDIVERT into my kernel - went fine. > >Here is my rc.conf network related entries; > >natd_enable="YES" >natd_interface="rl0" >natd_flags="-f /etc/natd.conf" >gateway_enable="YES" >ifconfig_rl0="inet 64.40.244.36 netmask 255.255.255.240" >defaultrouter="64.40.244.33" >ifconfig_vr0="DHCP" >ifconfig_vr0=up >ifconfig_vr0="inet 192.168.1.1" >network_interfaces="rl0 vr0 lo0" >ifconfig_lo0="inet 127.0.0.1" >firewall_enable="YES" >firewall_script="/etc/firewall.rules" >firewall_type="simple" >firewall_logging="YES" >dhcpd_ifaces="vr0" >dhcpd_enable="YES" > >My firewall rules; > >ipfw add 64000 allow ip from any to any >ipfw add divert natd all from any to any via rl0 >ipfw add allow tcp from any to 192.168.2.1 139 >ipfw add allow tcp from any to 192.168.1.1 139 >ipfw add 6000 deny tcp from any to 64.40.244.36 139 >ipfw add 6010 deny tcp from any to 64.40.244.36 445 >ipfw add deny tcp from any to any 139 > >My /etc/natd.conf; > >interface rl0 >use_sockets yes >same_ports yes > >My /etc/services includes the line; > >natd 8668/divert # Network Address Translation socket > >Output of ifconfig; > ># ifconfig >fwe0: flags=8802 mtu 1500 > ether 02:11:d8:b3:0e:43 > ch 1 dma -1 >vr0: flags=8843 mtu 1500 > inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 > inet6 fe80::16d6:4dff:fe47:88ae%vr0 prefixlen 64 scopeid 0x2 > ether 14:d6:4d:47:88:ae > media: Ethernet autoselect (100baseTX ) > status: active >rl0: flags=8843 mtu 1500 > inet 64.40.244.36 netmask 0xfffffff0 broadcast 64.40.244.47 > inet6 fe80::211:95ff:fe66:7162%rl0 prefixlen 64 scopeid 0x3 > ether 00:11:95:66:71:62 > media: Ethernet autoselect (100baseTX ) > status: active >lp0: flags=8810 mtu 1500 >lo0: flags=8049 mtu 16384 > inet6 ::1 prefixlen 128 > inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5 > inet 127.0.0.1 netmask 0xff000000 >ppp0: flags=8010 mtu 1500 >sl0: flags=c010 mtu 552 >faith0: flags=8002 mtu 1500 > > >From my initial communication I have swapped the uses of the two network >cards - which explains the reversal of entries for devices vr0 and rl0. >Still I have server connection to the internet on rl0 and server >connection to the network on vr0 - but the network cannot connect >to the internet via rl0. > >If there are any commands that would help collect information leading >to the answer I would appreciate any feedback. > Try using the examples here: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html That freebsddiary article is very old, and many versions ago. Essentially you need to forward the packets from your NAT'd private interface over to the interface on the internet. You can try this using an open firewall, sending all packets to test the setup. Then add rules to lock it down to only the ports you want to allow. -Derek -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.