Skip to Content.
Sympa Menu

baslinux - Re: [BL] gateway between two laptops

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: baslinux AT lists.ibiblio.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] gateway between two laptops
  • Date: Mon, 25 Aug 2008 14:14:22 +0000 (UTC)


ipchains -A forward -i eth0 -j MASQ

Last time around I think we were using -s 192.168.1.0/24 instead, so I have done some reading to try to understand the difference (see below).

Thank, you, Steven. It obviously was the ethN parameter that
was missing. Now the gateway is working. I probably can even log
in with DOS from the client machine.

Here is the summary:

I am trying to understand your setup:

eth0 Onboard (PCI) ethernet controller (eth0).

eth1

pcmcia wireless card, communicating with wireless router on another floor. Can you assign eth1 IP number with ifconfig instead, if you know its range of IP numbers and how many other computers are communicating with it?


------ GW-UP -------------
#!/bin/sh
# load drivers eth0 = LAN ethernet PCI, eth1 = wireless PCMCIA
insmod eepro100
/etc/pcmcia/start
# connect to internet router
udhcpc -i eth1
# connect to LAN
ifconfig eth0 192.168.1.1
# enable forwarding
ipchains -P forward DENY
ipchains -A forward -i eth1 -j MASQ
echo 1 > /proc/sys/net/ipv4/ip_forward
---------------------------

Connect your desktop via cable to the laptop gateway, then pass signals back and forth between it and the wireless router over the wireless router.

------ LAN-UP -------------
#!/bin/sh
# load driver eth0 = LAN ethernet PCMCIA
/etc/pcmcia/start
# connect to LAN
ifconfig eth0 192.168.1.2
# establish up gateway to share internet connection
route add default gw 192.168.1.1
---------------------------

Christof

I found some tutorials on IPCHAINS.
http://www.tldp.org/HOWTO/IPCHAINS-HOWTO.html (2000)
http://www.syrlug.org/contrib/ipchains.html (tutorial)
http://www.linuxplanet.com/linuxplanet/tutorials/2100/3

All about firewalls, routing, port forwarding, masquing. Ipchains ns is a rewrite of IPv4 and ipfwadm which started in linux 2.1, and is more powerful and easier to set up.

The HOWTO also explain packets filtering (whether to accept or deny or reject packets based on the header). You can set your filter to not accept packets with headers from certain IP addresses that you know only send ads. (That may be how registered copies of Arachne eliminated banner ads). You can prevent other people from telnetting to your network.

If your kernel has ipchains you will see a /proc/net/ip_fwchains (I also have ip_fwname and ip_masquerade).

To configure a 2.2 kernel for ipchains
CONFIG_FIREWALL=Y
CONFIG_IP_FIREWALL=Y
(It was different for 2.4, which by default uses some other method now).

Then ipchains communicates with the kernel to filter packets.

There are ways to make the setup permanent.

Besides packet filtering, ipchains controls masquerading The tldp example uses not
ipchains -A forward -s 192.168.1.0/24 -j MASQ
but
ipchains -A forward -i ppp0 -j MASQ

The masquerade howto link at tldp is broken, use:

http://linuxselfhelp.com/HOWTO/IP-Masquerade-HOWTO/index.html

The -s part lets internal interfaces MASQ out to the Internet (via a router, which the tldp example did not use), whereas the -i part is for communication inside your local network (which I did not have except for between client and gateway) and Steven's setup omits it.

IP Masquerade is the linux function similar to a firewall or network router. It works via PPP or ethernet etc and lets computers on an internal LAN connected to a gateway (which has internet connection) use this connection even though they don't have IP addresses on the external network (that of the router to which the gateway is connected, or the ISP assigned IP address when you dial in). It also adds security.

You can use browsers, telnet, ssh, ping, traceroute over this setup.
For ftp, irc, and realaudio you need extra IP MASQ modules. (I did not try these). Streaming MP3 should work.

You should be able to use it to connect linux and DOS-based systems with packet drivers and NCSA Telnet package.

The MASQ server apparently edits packet headers, changing the IP addresses between that of the gateway and the local computer(s), so that local computers act as if they are on the external network which is connected to the internet via router or modem.

Kernel 2.0 used IPFWADM, 2.2 used IPCHAINS, and 2.4 usually uses IPTABLES but I compiled with IPCHAINS so I could use Steven's setup. IPTABLES is better but is more complicated.

I read the 2.2 HOWTO section (IPCHAINS).

Slackware 2.2 kernels should have ipchains function built in. Check the
config files for the above two lines with Y.

Setting up IP Masquerade has info on compiling kernels.

192.169.0.1 is recommended for the gateway IP number (but if you are using a router it has its own default IP number).
(Steven, please correct me here).

The example here is for two client machines 192.168.0.2 and .8

ipchains -P forward DENY
ipchains -A forward -i $EXTIF -s 192.168.0.2/32 -j MASQ
ipchains -A forward -i $EXTIF -s 192.168.0.8/32 -j MASQ

The /32 is a 32-bit subnet mask (with a 32-bit routing prefix) and we have 24-bit (wikipedia). 255.255.255.0 is the subnet mask for the 192.168.1.0 network with 24-bit routing prefix (192.168.1.0/24). (???).

I don't understand much of this beyond the fact that information packets are being sent to and from the gateway from computers with IP numbers listed on the forward lines, and the gateway changes the IP numbers of the packet headers to match those of the external network (that the router is on, or the assigned IP numbers when you dial the ISP).


Chapter 4.5 discusses configuring DOS.
http://www.linuxselfhelp.com/HOWTO/IP-Masquerade-HOWTO/x1188.htm


A site for beginners:

http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?UNIX03/IPChains_Commands

The two most commonly used features of ipchains:
ipchains -P chain target [options]
ipchains -A chain rule [options]
(Forget about -ADC -RI -D -LFZNX and -M -L -S -h)

Target - default policy, can be ACCEPT, DENY, REJECT, MASQ, REDIRECT or RETURN. In our case, default is to DENY.

ipchains -P forward DENY
default is to deny a packet if it does not meet the rules to be forwarded to the local network (client computer)


ipchains -A forward XXXXX -j MASQ
adds rules to a given chain.

In our case I think -s 192.168.0.1/24 (anything on our LAN) is masqueraded, meaning packet headers are rewritten by the gateway to make it look like clients are part of the external network.

You can probably add more stuff to block packets from certain IP numbers.

Steven, please correct any misinformation above.




Archive powered by MHonArc 2.6.24.

Top of Page