Greetings all. Hope the weather in bejing is pleasant, Mr Wu. On Mon, 14 May 2007 11:58:34 -0300 (ART) "Norberto Bensa" <[EMAIL PROTECTED]> wrote:
> On Mon, May 14, 2007 8:23 am, Chuanwen Wu wrote: > > Thank you!I think i have done what you meant. > > Here is the information: > > > > > > /etc/conf.d/net in the server > > config_eth0=( "202.114.10.134 netmask 255.255.255.0 brd > > 202.114.10.255" ) routes_eth0=( "default gw 202.114.10.129" ) > > OK > > > > config_eth1=( "192.168.1.63 netmask 255.255.255.0 brd > > 192.168.1.255" ) routes_eth1=( "default gw 192.168.1.1" ) > > You don't need a route here. More exactly, a route to the subnet 192.168.1.0/24 will automatically be created through eth1. A _gateway_ in this case is not necessary because eth1 lives on that subnet. > > > /etc/conf.d/net in one PC > > config_eth0=( "192.168.1.35 netmask 255.255.255.0 brd > > 192.168.1.255" ) routes_eth0=( "default gw 192.168.1.1" ) > > No. GW should be 192.168.1.63, which is the IP address of your > gateway. > HTH, > Norberto > First, the firewall configuration. Your first message said: > The eth0 here has the real ip,and the eth1 have a subnet > ip:192.168.1.21. But here you show that you set it to .63, as Norberto pointed out. I assume that was just a typographical error in the first email. Moving on, the default route for the firewall is probably to the outside world, and if you can ping google.com, it works. Second, the client configuration. The route for the subnet it's on (192.168.1/24) is automatically created, as before. The default route is the IP of the firewall/gateway it's behind, namely 192.168.1.63 as Norberto said. The machine that's forwarding packets to the internet for these hosts now provides the route to the outside world for these hosts. Third, you must tell your client PCs nameservers, so that they can resolve domain names. If you fail to do so, even though a ping of google.com, for example, fails, a ping of its ip address (64.233.167.99, in my case) will work. Fourth, you must check your firewall (that is, iptables) configuration to be sure your iptables all refer to the correct subnet. > iptables --table nat -A POSTROUTING -s 192.168.8.0/24 -j MASQUERADE that wasn't right -- obviously the subnet should be your own. Since the firewall you're building knows all the information the hosts need to know (subnet information, routes, etc) you may wish to set up a rudimentary DHCP server on it, so that additional hosts can be added without configuration by the user. You may also wish to impliment a caching, recursive nameserver for enhanced efficiency. DNSMasq can do both. -- [EMAIL PROTECTED] mailing list
