First of all, thanks to all who responded to my initial post.
This includes Mark, Scott, Matt, Charles, David, Sean, Michael,
and Richard. I've tried pretty much everything that's been
suggested: setting various dhclient parameters, setting HOSTNAME
and HOSTS0, etc. Unfortunately, I'm still having the same problem.
I figured it was time to post a more thorough support request.
Problem description: After being transitioned off of home.com to
attbi.com, I wasn't able to ping any addresses from my old LRP box.
I upgraded to Dachstein 1.0.2, but that didn't seem to make much
difference.
If I hook my win2k box directly into the cable modem, things work
fine. It gets assigned address 12.237.7.206, subnet 255.255.240.0,
and default gateway 12.237.0.1.
The fact that the router gets such a different configuration makes
me suspect its some sort of DHCP problem. But by all appearences,
DHCP works fine. It acquires its addresses from 12.237.0.1, which
happens to be the default gateway for the win2k box AND appears to
be the ONLY address that I can successfully ping from the router.
I've included the following information:
. network diagram
. dmesg output
. ip addr show
. ip route show
. ip neighbor show
. ip -s link show
. /etc/network.conf
. /etc/lrp.conf
. /etc/dhclient.conf
|
______|______
| |
| Cable Modem |
|_____________|
|
_________|________ eth0 DHCP 12.255.173.135
| |
| LRP Router |
|__________________|
| eth1 192.168.1.1
__|__
| |____ win2k PC 192.168.1.x
| H |____ win2k PC 192.168.1.y
| u |____ printer 192.168.1.z
| b |
|_____|
c696585-b: -root-
# dmesg
Linux version 2.2.19-3-LEAF (root@debian) (gcc version 2.7.2.3) #1 Sat Dec 1
12:15:05 CST 2001
BIOS-provided physical RAM map:
BIOS-88: 000a0000 @ 00000000 (usable)
BIOS-88: 00f00000 @ 00100000 (usable)
Console: colour VGA+ 80x25
Calibrating delay loop... 33.07 BogoMIPS
Memory: 14064k/16384k available (732k kernel code, 412k reserved, 432k data,
44k init)
Checking if this processor honours the WP bit even in supervisor mode... Ok.
Dentry hash table entries: 2048 (order 2, 16k)
Buffer cache hash table entries: 16384 (order 4, 64k)
Page cache hash table entries: 4096 (order 2, 16k)
CPU: Intel 486 DX/2 stepping 05
Checking 386/387 coupling... OK, FPU using exception 16 error reporting.
Checking 'hlt' instruction... OK.
POSIX conformance testing by UNIFIX
PCI: No PCI bus detected
Linux NET4.0 for Linux 2.2
Based upon Swansea University Computer Society NET3.039
NET4: Unix domain sockets 1.0 for Linux NET4.0.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
TCP: Hash tables configured (ehash 16384 bhash 16384)
Initializing RT netlink socket
Starting kswapd v 1.5
Software Watchdog Timer: 0.05, timer margin: 60 sec
Real Time Clock Driver v1.09
RAM disk driver initialized: 16 RAM disks of 6144K size
Floppy drive(s): fd0 is 1.44M
FDC 0 is an 8272A
RAMDISK: Compressed image found at block 0
RAMDISK: Uncompressing root archive: done.
RAMDISK: Auto Filesystem - minix: 2048i 6144bk 68fdz(68) 1024zs 2147483647ms
VFS: Mounted root (minix filesystem).
RAMDISK: Extracting root archive: done.
VFS: Disk change detected on device fd(2,44)
Freeing unused kernel memory: 44k freed
ne.c:v1.10 9/23/94 Donald Becker ([EMAIL PROTECTED])
NE*000 ethercard probe at 0x300: 00 40 05 fa 1b 80
eth0: NE2000 found at 0x300, using IRQ 10.
NE*000 ethercard probe at 0x340: 00 40 05 fa 00 52
eth1: NE2000 found at 0x340, using IRQ 11.
ip_masq_icq: using TCP port range 60200-61000
ip_masq_icq: loaded support on port 4000/UDP
Serial driver version 4.27 with MANY_PORTS MULTIPORT SHARE_IRQ enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
ttyS01 at 0x02f8 (irq = 3) is a 16550A
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=0 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=1 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=2 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=3 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=4 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=5 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=6 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=7 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=8 F=0x0000 T=64 (#18)
Packet log: input DENY eth0 PROTO=1 12.255.173.135:8 12.255.173.128:0 L=84
S=0x00 I=9 F=0x0000 T=64 (#18)
VFS: Disk change detected on device fd(2,0)
VFS: Disk change detected on device fd(2,0)
c696585-b: -root-
# ip addr show
1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope global lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:40:05:fa:1b:80 brd ff:ff:ff:ff:ff:ff
inet 12.255.173.135/28 brd 255.255.255.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:40:05:fa:00:52 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.254/24 brd 192.168.1.255 scope global eth1
c696585-b: -root-
# ip route show
12.255.173.128/28 dev eth0 proto kernel scope link src 12.255.173.135
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.254
default via 12.255.173.129 dev eth0
c696585-b: -root-
# ip neighbor show
c696585-b: -root-
# ip -s link show
1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:40:05:fa:1b:80 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
25458 409 0 0 0 395
TX: bytes packets errors dropped carrier collsns
5568 53 0 0 0 0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:40:05:fa:00:52 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
#ZZZZZZZZZZZ
c696585-b: -root-
# cat /etc/networks .conf
############################################################################
###
# Extended firewall configruation scripts
# By Charles Steinkuehler
# Version 1.3.2
# September 29, 2001
############################################################################
###
# Brief instructions for this file
############################################################################
###
#
# VERBOSE=(YES/NO) Default: Yes
# Be verbose about settings.
#
# MAX_LOOP=(int) Default: 10
# Maximum number of incrementable entries to search for.
# IE: If you create a DNS7=, and MAX_LOOP=7, it will not be reached.
# (DNS0 - DNS7 == 8 entires)
# Setting this value too high will decrease the speed of the configuation
# system.
#
# IPFWDING_KERNEL=(YES/NO/FILTER_ON) Default: NO
# Enable IP forwarding in the kernel. FILTER_ON means forwarding will
# only happen when IP filtering rules are loaded
#
# IPALWAYSDEFRAG_KERNEL=(YES/NO) Default: NO
# Enable IP Global defragmentation in the kernel.
#
# **WARNING** - If this was turned on everywhere in a network of routers,
# it can result in TCP connections failing and TCP connection resets.
#
# ONLY turn this on if the box is a firewall or the single point of
# entry for a network, or an endpoint for port forwarding or a load
# balancer for a WWW server farm. DO NOT turn this on if the box is a
# conventional router as it breaks the TCP/IP RFCes. This option is
# needed when using IP NAT, IP masquerading, IP autofw, IP portfw,
# transperent proxying or other kernel operations that intercept a
# packet flow and redirect it.
#
# It is a usful tool when using a packet filtering router to protect
# directly attached ethernet networks of servers as it stops fragment
# attacks on the servers in behind the router. Another use is packet
# filtering router to protect dial-in Internet users on NASes
# (Portmasters, TC racks etc) from various SMB and fragment attacks
# and to redirect all WWW connections into a WWW proxy-caching server.
#
# CONFIG_HOSTNAME=(YES/NO) Default: NO
# Create /etc/hostname file using HOSTNAME entry.
# Any current hostname file will be **OVERWRITTEN**
#
# CONFIG_HOSTSFILE=(YES/NO) Default: NO
# Create /etc/hosts file using HOSTSx entries.
# Any current hosts file will be **OVERWRITTEN**
#
# CONFIG_DNS=(YES/NO) Default: NO
# Create /etc/resolv.conf file using DOMAINS and DNSx entries.
# Any current resolv.conf file will be **OVERWRITTEN**
#
# IF_LIST Default: "$IF_AUTO"
# A space seperated list of interfaces that can be ACTIVE on this machine
# This controls which interfaces can be brought up and down manually.
#
# IF_AUTO Default: "eth0"
# A space seperated list of interfaces that get started on boot. Tunneling
# interfaces like CIPE should be after the raw interfaces they depend on.
# The interfaces are started in the order they occur on the list, and are
# shutdown in the reverse order of IF_LIST.
#
# IPFILTER_SWITCH=(none|router|firewall) Default: "none"
# Selects the basic IP filtering/firewalling setup of the router. "None"
# is used for a straight through router, "router" for a filtering router
with
# IP spoof protection and Martian protection and "firewall" for a basic IP
# masquerading/NAT firewall. The basic filter types are provided in
# /etc/ipfilter.conf. If you want more than what is provided read the man
# pages for ipchains or ipfwadm and BE CAREFUL when you edit this!
#
############################################################################
###
# General Settings
############################################################################
###
VERBOSE=YES
MAX_LOOP=10
IPFWDING_KERNEL=FILTER_ON
IPALWAYSDEFRAG_KERNEL=YES
CONFIG_HOSTNAME=YES
CONFIG_HOSTSFILE=YES
CONFIG_DNS=NO
############################################################################
###
# Interfaces
############################################################################
###
# Start pppd PPP interfaces first as pppd's use of DNS can delay startup.
#
# Interfaces to start on boot go here - ie "ppp0 eth0"
# Do NOT include interfaces configured by dhcp!
IF_AUTO="eth1"
# List of all configured interfaces, manual start and boot start
IF_LIST="$IF_AUTO"
# Accept ICMP Redirects on ALL interfaces, also depends on /proc
# per interface IP forwarding flag. - YES/NO
ALLIF_ACCEPT_REDIRECTS=NO
# Need these both for interfaces run by daemons - ie PPP, CIPE, some
# WAN interfaces
# IP spoofing protection by default for interfaces - YES/NO
DEF_IP_SPOOF=YES
# Kernel logging of spoofed packets by default for interfaces - YES/NO
DEF_IP_KRNL_LOGMARTIANS=YES
# Bridge Setup - Global stuff
#
# Enable bridging - YES/NO
BRG_SWITCH=NO
# Exempt ethernet protocol types - type "brcfg list" to find out allowed
# values
BRG_EXEMPT_PROTOS=""
############################################################################
###
eth0_IPADDR=1.1.1.2
eth0_MASKLEN=30
eth0_BROADCAST=+
# Use this to set the default route if required - ONLY one to be set.
# routed or gated could be used to set this so only use if not running
these.
eth0_DEFAULT_GW=1.1.1.1
# Secondary IP addresses/networks on same wire - add them here
#eth0_IP_EXTRA_ADDRS="192.168.1.193 192.168.2.1/24"
# Additional routes for this interface, if any
# Space seperated list: <PREFIX>[_<more ip route options>]
#eth0_ROUTES="1.1.1.13 2.2.2.0/24_via_1.1.1.18"
# IP spoofing protection on this interface - YES/NO
eth0_IP_SPOOF=YES
# Kernel logging of spoofed packets on this interface - YES/NO
eth0_IP_KRNL_LOGMARTIANS=YES
# This setting affects the processing of ICMP redirects. Setting it to NO
# makes this more secure. Don't turn this off if you have two IP
# networks/subnets on the same media - YES/NO
eth0_IP_SHARED_MEDIA=NO
# Bridge this interface - YES/NO
eth0_BRIDGE=NO
# Proxy-arp from this interface, no other config required to turn on proxy
ARP!
# - YES/NO
eth0_PROXY_ARP=NO
# Simple QoS/fair queueing support
# Turn on Stochastic Fair Queueing - useful on busy DDS links - YES/NO
eth0_FAIRQ=NO
# Ethernet Transmit Queue Length
# eth0_TXQLEN=100
# Complex QoS - Enable all of these + above to turn it on
#eth0_BNDWIDTH=10Mbit # Device bandwidth
#eth0_HNDL=2 # Queue Handle - must be unique
#eth0_IABURST=100 # Interactive Burst
#eth0_IARATE=1Mbit # Interactive Rate
#eth0_PXMTU=1514 # Physical MTU - includes Link Layer header
############################################################################
###
eth1_IPADDR=192.168.1.254
eth1_MASKLEN=24
eth1_BROADCAST=+
eth1_IP_SPOOF=YES
eth1_IP_KRNL_LOGMARTIANS=YES
eth1_IP_SHARED_MEDIA=NO
eth1_BRIDGE=NO
eth1_PROXY_ARP=NO
eth1_FAIRQ=NO
############################################################################
###
#eth2_IPADDR=
#eth2_MASKLEN=
#eth2_BROADCAST=+
#eth2_ROUTES=
#eth2_IP_SPOOF=YES
#eth2_IP_KRNL_LOGMARTIANS=YES
#eth2_IP_SHARED_MEDIA=NO
#eth2_BRIDGE=NO
#eth2_PROXY_ARP=
#eth2_FAIRQ=NO
############################################################################
###
# NAT 'virtual' interface (optional: required only for static-NAT DMZ
systems)
############################################################################
###
# Configured as an interface to allow flexible handling of bringing the
# routing rules up/down in conjunction with the physical interfaces
# interface spec is an indexed list of IP address pairs and a base priority
# number for ip rule creation
#nat0_BASE_PRI=100 # Unique base value for ip rules
# Indexed list: <public IP> <private DMZ IP>
#nat0_PAIR0="1.1.2.3 192.168.2.13"
#nat0_PAIR1="1.1.2.4 192.168.2.14"
#nat0_PAIR2="1.1.2.5 192.168.2.15"
# Sangoma FR example
#fr498_IPADDR=10.0.10.1
#fr498_PTPADDR=10.0.10.2
#fr498_IP_SPOOF=YES
#fr498_IP_KRNL_LOGMARTIANS=YES
# Simple QoS support
#fr498_FAIRQ=YES
#fr498_TXQLEN=50
# Complex FR QoS - Enable ALL of these + above to turn it on
#fr498_FRBURST=960Kbit # FR Burst capacity (a rate)
#fr498_BULKRATE=320Kbit # Usually you set this to the CIR
#fr498_BULKBURST=50 # Number of packets that can burst in bulk class
#fr498_BNDWIDTH=1920Kbit # The bandwidth of the interface
#fr498_IABURST=512 # No of Interactive Burst packets
#fr498_IARATE=640Kbit # Burst capicity bandwith between
# BURST and CIR
#fr498_HNDL=2 # The queue handle - must be unique Dialup PPP is 1000+
#fr498_PXMTU=1508 # The Physical MTU of the interface (data + MAC header)
# PPP interface stuff - these apply to all ASYNC ppp interfaces, options
# same as ethernet above.
#ppp_BNDWIDTH=30Kbit
#ppp_FAIRQ=YES
#ppp_TXQLEN=30
#ppp_IABURST=20
#ppp_IARATE=10Kbit
#ppp_PXMTU=1500
############################################################################
###
# IP Filter setup - can pull in settings from above
############################################################################
###
# Set up the basic type of filtering. Can be one of (none|router|firewall)
# You must load the ip_masq_* modules to enable full IP masquerading, and
# ip_masq_portfw if you want to forward external ports pop-3, mtp, www
# to internal machines below.
IPFILTER_SWITCH=firewall
# This set of variables is used with both sets of filters
SNMP_BLOCK=YES # Block all SNMP (YES/NO)
# List of IP Nos used for SNMP management
#SNMP_MANAGER_IPS="10.100.1.2"
# Fair Queuing support
# List of Mark values
MRK_CRIT=1 # Critical traffic, routing, DNS
MRK_IA=2 # Interactive traffic - telnet, ssh, IRC
# List of traffic types and maps to mark values
# Setting this variable turns on the
# fairq chain
CLS_FAIRQ="${MRK_CRIT}_89_0/0 ${MRK_CRIT}_udp_0/0_route
${MRK_CRIT}_tcp_0/0_bgp ${MRK_CRIT}_tcp_0/0_domain
${MRK_CRIT}_udp_0/0_domain ${MRK_IA}_tcp_0/0_telnet ${MRK_IA}_tcp_0/0_ssh"
# NOTE: Do NOT turn on the DMZ network or ANY external port masquerading/
# port forwarding when EXTERN_DYNADDR is on because some security
# leaks will result. You may also want to limit the external open
# ports to domain (UDP) for DNS. Anyhow, these features are not that
# usable unless you have a static external address
#
EXTERN_IF="eth0" # External Interface
# Added for DHCP support
# Setting this to YES causes the dhcp client to try to configure the
# interfaces listed in IF_DHCP, and causes EXTERN_IP to be read directly
# from the interfaceB
EXTERN_DHCP=YES # YES/NO
# The interface(s) to configure via dhcp
IF_DHCP=$EXTERN_IF
# If YES, your firewall filters use 0/0 for your IP address, instead of your
# actual IP address. Set this to NO for typical ethernet setups, even if
you
# are using DHCP
EXTERN_DYNADDR=NO # YES/NO
# - or -
# External Interface IP number...the default should be fine for most folks
eval EXTERN_IP=\"\${"$EXTERN_IF"_IPADDR:-""}\"
# Set EXTERN_IP to "DYNAMIC" if you need the rules to read the IP from the
# interface, but you arn't using DHCP (ie PPPoE and dialup users)
#EXTERN_IP=DYNAMIC
# If external interface IP is dynamic, read the configured IP address
# This should probably be moved to the init.d network script, but I put it
# here for now, as it is more obvious what it is doing, in case it
# messes something else up.
if [ "$EXTERN_DHCP" = "YES" -o \
"$EXTERN_DHCP" = "Yes" -o \
"$EXTERN_DHCP" = "yes" -o \
"$EXTERN_IP" = "DYNAMIC" ] ; then
# This computes the IP address of $EXTERN_IF
EXTERN_IP=`ip addr list label $EXTERN_IF | \
grep inet | sed '1!d' | \
sed 's/^[^.0-9]*\([.0-9]*\).*$/\1/'`
# If the external address is not configured, use a bogus address for the
# external interface to prevent a bunch of (harmless) errors that spit out
# when the IPCHAINS script is called.
if [ x$EXTERN_IP = x ]; then
EXTERN_IP=192.168.254.254
fi
fi
# Traffic to completely ignore...define here to prevent filling your logs
# Space seperated list: protocol_srcip[/mask][_dstport]
#SILENT_DENY="udp_207.235.84.1_route udp_207.235.84.0/24_37"
# Extra rule scripts added by Charles Steinkuehler to more easily support
# non-standard extentions of the pre-configured ipchains rules
IPCH_IN=/etc/ipchains.input
IPCH_FWD=/etc/ipchains.forward
IPCH_OUT=/etc/ipchains.output
# ICMP types to open
# Indexed list: "SrcAddr/Mask type [ DestAddr[/DestMask] ]"
#EXTERN_ICMP_PORT0="0/0 : 1.1.1.12"
## UDP Services open to outside world
# Space seperated list: srcip/mask_dstport
# NOTE: bootpc port is used for dhcp client
EXTERN_UDP_PORTS="0/0_domain 0/0_bootpc"
# -or-
# Indexed list: "SrcAddr/Mask port [ DestAddr[/DestMask] ]"
#EXTERN_UDP_PORT0="0/0 domain"
#EXTERN_UDP_PORT1="5.6.7.8 500 1.1.1.12"
# TCP services open to outside world
# Space seperated list: srcip/mask_dstport
#EXTERN_TCP_PORTS="216.171.153.128/25_ssh 0/0_www 0/0_1023"
# -or-
# Indexed list: "SrcAddr/Mask port [ DestAddr[/DestMask] ]"
#EXTERN_TCP_PORT0="5.6.7.8 domain 1.1.1.12"
#EXTERN_TCP_PORT1="0/0 www"
# Generic Services open to outside world
# Space seperated list: protocol_srcip/mask_dstport
#EXTERN_PORTS="50_5.6.7.8 51_5.6.7.8"
# -or-
# Indexed list: "Protocol SrcAddr/Mask [ DestAddr[/DestMask] ]"
#EXTERN_PROTO0="50 5.6.7.8/32"
#EXTERN_PROTO1="51 5.6.7.8/32"
############################################################################
###
# Internal Interface
############################################################################
###
# Comment 3 settings below for no internal network (DMZ only configuration)
INTERN_IF="eth1" # Internal Interface
INTERN_NET=192.168.1.0/24 # One (or more) Internal network(s)
INTERN_IP=192.168.1.254 # IP number of Internal Interface
# (to allow forwarding to external IP)
MASQ_SWITCH=YES # Masquerade internal network to outside
# world - YES/NO
# These services are not masqueraded from int to ext/DMZ, preventing access
# Space seperated list: proto_destIP/mask_port
#NOMASQ_DEST="tcp_0/0_ssh"
# Override for above...only the listed dest IP's can be accessed
# Space seperated list: proto_destIP/mask_port
#NOMASQ_DEST_BYPASS="tcp_10.0.0.1_ssh"
############################################################################
###
# Port Forwarding
############################################################################
###
# Remember to open appropriate holes in the firewall rules, above
# Uncomment following for port-forwarded internal services.
# The following is an example of what should be put here.
# Tuples are as follows:
# <protocol>_<local-ip>_<local-port>_<remote-ip>_<remote-port>
#INTERN_SERVERS="tcp_${EXTERN_IP}_ftp_192.168.1.1_ftp
tcp_${EXTERN_IP}_smtp_192.168.1.1_smtp"
# These lines use the primary external IP address...if you need to
port-forward
# an aliased IP address, use the INTERN_SERVERS setting above
#INTERN_FTP_SERVER=192.168.1.1 # Internal FTP server to make available
#INTERN_WWW_SERVER=192.168.1.1 # Internal WWW server to make available
#INTERN_SMTP_SERVER=192.168.1.1 # Internal SMTP server to make available
#INTERN_POP3_SERVER=192.168.1.1 # Internal POP3 server to make available
#INTERN_IMAP_SERVER=192.168.1.1 # Internal IMAP server to make available
#INTERN_SSH_SERVER=192.168.1.1 # Internal SSH server to make available
#EXTERN_SSH_PORT=24 # External port to use for internal SSH access
# Advanced settings: parameters passed directly to portfw and autofw
# Indexed list: "<ipmasqadm portfw options>"
#INTERN_SERVER0="-a -P PROTO -L LADDR LPORT -R RADDR RPORT [-p PREF]"
#INTERN_SERVER1=""
# Indexed list: "<ipmasqadm autofw options>"
#INTERN_AUTOFW0="-A -r tcp 20000 20050 -h 192.168.1.1"
#INTERN_AUTOFW1=""
############################################################################
###
# DMZ setup (optional)
############################################################################
###
# Whether you want a DMZ or not (YES, PROXY, NAT, PRIVATE, NO)
DMZ_SWITCH=NO
DMZ_IF="eth2"
DMZ_NET=192.168.2.0/24
# DMZ switches for all flavors except PRIVATE
############################################################################
###
# For NAT DMZ's:
# DMZ_NET, above is likely a private IP range...DMZ_SRC should encompass the
# public IP range being NAT'd to DMZ_NET. Any systems
DMZ_SRC=1.1.1.0/27
# For Proxy-Arp or NAT DMZ's only:
# For security, any IP's within the DMZ_NET (PROXY) or DMZ_SRC (NAT)
# specification, above, that are NOT remote systems reached via DMZ_IF must
# be listed here. This potentially includes IP's of this LRP system, your
# gateway, and systems connected to your external interface.
DMZ_EXT_ADDRS="$eth0_DEFAULT_GW $EXTERN_IP"
## Both of the following should be used together - ie if you turn on
## DMZ_HIGH_TCP_CONNECT - DO specify DMZ_CLOSED_DEST!
# Allows inbound connections to high tcp ports (>1023)
# You can also allow to specific machines using 1024: (or a smaller range)
# as the dest port range in DMZ_OPEN_DEST (RECOMMENDED)
DMZ_HIGH_TCP_CONNECT=NO
## 3306 MySQL, 6000 X, 2049 NFS, 7100 xfs
DMZ_CLOSED_DEST="tcp_${DMZ_NET}_6000:6004 tcp_${DMZ_NET}_7100"
# Inbound services to allow to the DMZ
# <protocol>_<destination IP/network>_<destination port or range>
DMZ_OPEN_DEST=" udp_${DMZ_NET}_domain
tcp_${DMZ_NET}_domain
icmp_${DMZ_NET}_:
tcp_1.1.2.13_www"
# PRIVATE DMZ switches
############################################################################
###
# Services port-forwarded to the DMZ network
# Indexed list: "Protocol LocalIP LocalPort RemoteIP [ RemotePort ]"
#DMZ_SERVER0="udp $EXTERN_IP domain 192.168.2.1 domain"
#DMZ_SERVER1="tcp $EXTERN_IP domain 192.168.2.1 domain"
#DMZ_SERVER2="tcp 1.2.3.13 www 192.168.2.1 www"
#DMZ_SERVER3="tcp 1.2.3.13 smtp 192.168.2.1 smtp"
#DMZ_SERVER4="tcp 1.2.3.12 www 192.168.2.1 8080"
# Allow all outbound traffic from DMZ (YES)
# or just traffic from port-forwarded servers (NO)
#DMZ_OUTBOUND_ALL=YES
############################################################################
###
# Interface activation/deactivation functions
# Here so that special interface commands can be called and daemons started
#
# Arps can be set up here, network/host routes and so forth.
#
# This appears to be a little messy but is needed to achieve maximum
# functionality and flexibility.
#
############################################################################
###
echo_rtepfx () {
local IFS='_'
set -- $1
echo $1
}
echo_rteargs () {
local IFS='_'
set -- $1
shift
echo $@
}
# Function to add a static NAT translation
# $1 = Name of environment variable which contains IP address
# $2 = Action (add or del)
# $3 = Base priority value
# $y = Current walklist index count
do_nat () {
local PRIORITY=$(($3 + $y ))
local ACTION=$2
eval local args=\$$1
set -- $args
ip route $ACTION nat $1 via $2
ip rule $ACTION prio $PRIORITY from $2 nat $1
}
if_up () {
local ADDR
# sort out a few things to make life easier - here so that you
# can see what is done and so that you can add anything if needed
eval local IPADDR=\${"$1"_IPADDR:-""} # I am also a good genius
eval local MASKLEN=\${"$1"_MASKLEN:-""}
eval local BROADCAST=\${"$1"_BROADCAST:-""}
eval local PTPADDR=\${"$1"_PTPADDR:-""}
eval local DEFAULT_GW=\${"$1"_DEFAULT_GW:-""}
eval local IP_EXTRA_ADDRS=\${"$1"_IP_EXTRA_ADDRS:-""}
eval local ROUTES=\${"$1"_ROUTES:-""}
eval local FAIRQ=\${"$1"_FAIRQ:-""}
eval local TXQLEN=\${"$1"_TXQLEN:-""}
eval local IP_SPOOF=\${"$1"_IP_SPOOF:-""}
eval local IP_KRNL_LOGMARTIANS=\${"$1"_IP_KRNL_LOGMARTIANS:-""}
eval local IP_SHARED_MEDIA=\${"$1"_IP_SHARED_MEDIA:-""}
eval local BRIDGE=\${"$1"_BRIDGE:-""}
eval local PROXY_ARP=\${"$1"_PROXY_ARP:-""}
if [ -n "$BROADCAST" ] ; then
IFCFG_BROADCAST="broadcast $BROADCAST"
fi
# Do dee global bridge stuff
brg_global
# Set default interface flags here - used for PPP and WAN interfaces
if_setproc default rp_filter $DEF_IP_SPOOF
if_setproc default log_martians $DEF_IP_KRNL_LOGMARTIANS
if_setproc all accept_redirects $ALLIF_ACCEPT_REDIRECTS
# Set up each interface
case $1 in
ppp0)
pppd call provider
;;
fr*)
wanconfig card wanpipe1 dev $1 start
ip addr add $IPADDR peer $PTPADDR dev $1
ip link set $1 up
# Fair queuing - this can be selected for any interface
ip_frQoS $1
;;
nat*)
eval local BASE_PRI=\${"$1"_BASE_PRI:-""}
walk_list $1_PAIR $INIT_INDEX do_nat add $BASE_PRI
;;
*) # default interface startup
brg_iface $1 up $BRIDGE
[ -n "$IPADDR" ] \
&& ip addr add $IPADDR/$MASKLEN $IFCFG_BROADCAST dev $1
for ADDR in $IP_EXTRA_ADDRS; do
ip addr add $ADDR dev $1
done
ip link set $1 up
case "$PROXY_ARP" in
YES|Yes|yes)
ip route flush dev $1
;;
*)
;;
esac
# Fair queuing - this can be selected for any interface
ip_QoS $1
;;
esac
for route in $ROUTES; do
ip route add `echo_rtepfx $route` dev $1 `echo_rteargs $route`
done
# Do universal interface config items here
# Default route support
[ -n "$DEFAULT_GW" ] \
&& ip route replace default via $DEFAULT_GW dev $1
# Set the TX Queue Length
[ -n "$TXQLEN" ] \
&& ip link set $1 txqlen $TXQLEN
# Spoof protection
if_setproc $1 rp_filter $IP_SPOOF
# Kernel logging of martians on this interface
if_setproc $1 log_martians $IP_KRNL_LOGMARTIANS
# Shared Media stuff
if_setproc $1 shared_media $IP_SHARED_MEDIA
# Proxy ARP support
if_setproc $1 proxy_arp $PROXY_ARP
return 0
}
if_down () {
# Do Dee global bridge stuff
brg_global
case $1 in
ppp*)
[ -f /var/run/$1.pid ] && qt kill `cat /var/run/$1.pid`
sleep 5 # Wait for pppd to die
;;
fr*)
qt ip link set $1 down
qt ip addr flush dev $1
qt wanconfig card wanpipe1 dev $1 stop
;;
nat*)
eval local BASE_PRI=\${"$1"_BASE_PRI:-""}
walk_list $1_PAIR $INIT_INDEX do_nat del $BASE_PRI
;;
*) # default action
brg_iface $1 down
ip link set $1 down # This also kills any routes
qt ip addr flush dev $1
;;
esac
# Clean up any QoS/fair queuing stuff
ip_QoSclear $1
true
} #END if_down
############################################################################
###
# Hostname Requires: CONFIG_HOSTNAME=YES
############################################################################
###
HOSTNAME="c696585-b"
############################################################################
###
# Hosts file (Static domainname entires) Requires: CONFIG_HOSTSFILE=YES
############################################################################
###
# IP FQDN hostname alias1 alias2..
HOSTS0="$eth1_IPADDR $HOSTNAME.attbi.com $HOSTNAME fw"
#HOSTS0="$eth1_IPADDR $HOSTNAME.private.network $HOSTNAME fw"
#HOSTS1="192.168.1.22 host2.private.network host2 h2"
############################################################################
###
# Domain Search Order and Name Servers Requires: CONFIG_DNS=YES
############################################################################
###
DOMAINS="private.network"
DNS0=127.0.0.1
#DNS0=Your.Primary.DNS.Server
#DNS1=Your.Secondary.DNS.Server
############################################################################
###
# QoS/Fariqueing functions
############################################################################
###
ip_QoSclear () {
[ -x /sbin/tc ] \
&& qt tc qdisc del dev $1 root
return 0
}
ip_frQoS () {
# Set some vaiables
eval local FAIRQ=\${"$1"_FAIRQ:-""}
eval local BULKRATE=\${"$1"_BULKRATE:-""}
eval local BULKBURST=\${"$1"_BULKBURST:-""}
eval local FRBURST=\${"$1"_FRBURST:-""}
eval local HNDL=\${"$1"_HNDL:-""}
eval local BNDWIDTH=\${"$1"_BNDWIDTH:-""}
eval local IARATE=\${"$1"_IARATE:-""}
eval local IABURST=\${"$1"_IABURST:-""}
eval local PXMTU=\${"$1"_PXMTU:-""}
if [ ! -x /sbin/tc ]; then
return 1
fi
if [ "$FAIRQ" != "YES" -a "$FAIRQ" != "Yes" -a "$FAIRQ" != "yes" ]
then
return 1
fi
if [ -z "$BULKRATE" -o -z "$FRBURST" -o -z "$HNDL" -o -z "$PXMTU" \
-o -z "$BNDWIDTH" -o -z "$IARATE" -o -z "$IABURST" \
-o -z "$BULKBURST" ]; then
tc qdisc replace dev $1 root sfq
return 0
fi
# Attach CBQ to device
tc qdisc add dev $1 root handle $HNDL: cbq \
bandwidth $BNDWIDTH avpkt 1000
# Set up classes
# Bulk class
tc class add dev $1 parent $HNDL:0 classid :1 \
est 1sec 8sec cbq bandwidth $BNDWIDTH \
rate $BULKRATE allot $PXMTU bounded weight 1 prio 6 \
avpkt 1000 maxburst $BULKBURST \
split $HNDL:0 defmap ff7f
tc qdisc add dev $1 parent $HNDL:1 sfq perturb 15
# Interactive Class
tc class add dev $1 parent $HNDL:0 classid :2 \
est 2sec 16sec cbq bandwidth $BNDWIDTH \
rate $IARATE allot $PXMTU bounded weight 1 prio 6 \
avpkt 1000 maxburst $IABURST \
split $HNDL:0 defmap 80
tc qdisc add dev $1 parent $HNDL:2 sfq perturb 15
# Priority class
tc class add dev $1 parent $HNDL:0 classid :3 \
est 1sec 8sec cbq bandwidth $BNDWIDTH \
rate $FRBURST allot $PXMTU bounded weight 1 prio 1 \
avpkt 1000 maxburst 21
tc qdisc add dev $1 parent $HNDL:3 pfifo
# Add filters
tc filter add dev $1 parent $HNDL:0 protocol ip \
priority 50 handle $MRK_CRIT fw classid $HNDL:3
tc filter add dev $1 parent $HNDL:0 protocol ip \
priority 60 handle $MRK_IA fw classid $HNDL:2
return 0
}
ip_QoS () {
# Set some vaiables
eval local HNDL=\${"$1"_HNDL:-""}
eval local FAIRQ=\${"$1"_FAIRQ:-""}
if [ -z "$FAIRQ" -a -n "$2" ]; then
local FAIRQ=$2
fi
eval local BNDWIDTH=\${"$1"_BNDWIDTH:-""}
if [ -z "$BNDWIDTH" -a -n "$3" ]; then
local BNDWIDTH=$3
fi
eval local PXMTU=\${"$1"_PXMTU:-""}
if [ -z "$PXMTU" -a -n "$4" ]; then
local PXMTU=$4
fi
eval local IARATE=\${"$1"_IARATE:-""}
if [ -z "$IARATE" -a -n "$5" ]; then
local IARATE=$5
fi
eval local IABURST=\${"$1"_IABURST:-""}
if [ -z "$IABURST" -a -n "$6" ]; then
local IABURST=$6
fi
if [ ! -x /sbin/tc ]; then
return 1
fi
if [ "$FAIRQ" != "YES" -a "$FAIRQ" != "Yes" -a "$FAIRQ" != "yes" ]
then
return 1
fi
if [ -z "$BNDWIDTH" -o -z "$IABURST" -o -z "$IARATE" -o -z "$HNDL" \
-o -z "$PXMTU" ]; then
tc qdisc replace dev $1 root sfq
return 0
fi
# Attach CBQ to device
tc qdisc add dev $1 root handle $HNDL: cbq \
bandwidth $BNDWIDTH \
avpkt 1000
# Set up classes
# Bulk class
tc class add dev $1 parent $HNDL:0 classid :1 est 1sec 8sec \
cbq bandwidth $BNDWIDTH rate $BNDWIDTH \
allot $PXMTU avpkt 1000 bounded weight 1 prio 6 \
split $HNDL:0 defmap ff7f
tc qdisc add dev $1 parent $HNDL:1 sfq perturb 15
# Interactive class
tc class add dev $1 parent $HNDL:0 classid :2 est 2sec 16sec \
cbq bandwidth $BNDWIDTH rate $IARATE maxburst $IABURST \
allot $PXMTU avpkt 1000 bounded isolated weight 1 \
prio 2 split $HNDL:0 defmap 80
tc qdisc add dev $1 parent $HNDL:2 sfq perturb 15
# Priority class
tc class add dev $1 parent $HNDL:0 classid :3 est 1sec 8sec \
cbq bandwidth $BNDWIDTH rate $BNDWIDTH \
allot $PXMTU avpkt 1000 bounded weight 1 prio 1
tc qdisc add dev $1 parent $HNDL:3 pfifo
# Add filters
tc filter add dev $1 parent $HNDL:0 protocol ip \
priority 50 handle $MRK_CRIT fw classid $HNDL:3
tc filter add dev $1 parent $HNDL:0 protocol ip \
priority 60 handle $MRK_IA fw classid $HNDL:2 \
return 0
}
############################################################################
###
# End
############################################################################
###
#ZZZZZZZZZZZ
c696585-b: -root-
# cat /etc/lrp.conf
#This is the master config file for systemwide LRP functions.
#It is referenced by multicron-* and POSIXness.
# Log files in /var/log/ to rotate. DEPTH == Amount to keep.
lrp_LOGS_DAILY="daemon.log debug kern.log messages syslog user.log \
ppp.log pslave.log"
lrp_LOGS_WEEKLY="auth.log lastlog"
lrp_LOGS_MONTHLY="wtmp"
lrp_LOGS_DEPTH=4
# Host SMTP server for the 'mail' command. If blank the host 'mail' is used.
#lrp_MAIL_SERVER="smtp.mydomain.net"
# Email address to use for notices and alerts. If blank alerts won't be
sent.
#lrp_MAIL_ADMIN="[EMAIL PROTECTED]"
# Server that will be contacted via 'rdate' for the time service daily.
# Turning this on also updates the CMOS clock
#lrp_DATE_SERVER="date.mydomain.net"
# List of hosts to ping check. ADMIN will be sent mail if any fail.
#lrp_PING_HOSTS="router1.upstream.com server2.theirnet.org"
# SPACECHECK, will check the space available on the root device.
# If the remaining free space is <= MINKB or <= MINPER, each level
# of file mask(s) will be wiped, until the minimum available space
# is met or level 5 is reached. Files are individually null'ed
# to 0 size. They are not rm'ed. (syslogd will not be interrupted)
# When the level set in MAIL_LEVEL, is reached or exceeded, an
# alert will be sent to ADMIN. (If set)
lrp_SPACECHECK=NO # YES or NO
lrp_SC_MINKB=-1 # <= -1 to disable.
lrp_SC_MINPER=2 # >= 101 to disable. Default 2%.
lrp_SC_MAIL_LEVEL=2 # >= 6 to disable.
lrp_SC_DEL_L1="/var/log/*[4-9].gz"
lrp_SC_DEL_L2="/var/log/*[1-3].gz"
lrp_SC_DEL_L3="/var/log/*.gz"
lrp_SC_DEL_L4="/var/log/*.0"
lrp_SC_DEL_L5="/var/log/wtmp"
#ZZZZZZZZZZZ
c696585-b: -root-
# cat /etc/dhclient.conf
# Defaults are OK for most users
#
# You may have to send a specific host-name or dhcp-client-identifier to
# your ISP, depending on how they assign leases. Note that some ISP's
# assign leases based on physical ethernet addresses, so you may have to use
# the interface priovided by your ISP (or ask them to update their records
to
# match your 'new' network card) in order to use dhcp, even though you might
# be able to ping or otherwise send data through your network connection.
# Other ISP's use cable and DSL modems that check for the physical address
# of your network card and you won't even be able to ping through the
interface
# (or aquire a dhcp lease) without swapping network cards, resetting your
# modem, or perhaps jumping through other hoops. Check with a local linux
# group to get details on service providers in your area.
#
# If you do need to send a specific host-name or dhcp-client-identifier,
# you can uncomment the appropriate lines below, and change the parameters
# to match your system
#send host-name "c696585-b";
# Both forms below are identical. Use whichever is most appropriate
# for the client-identifier you need to send (ascii or colon seperated
# hexadicemal octets)
# send dhcp-client-identifier 43:4c:49:45:4e:54:2d:46:4f:4f;
# send dhcp-client-identifier "CLIENT-FOO";
# See the ISC dhcp documentation for more details on this file
# Use local DNSCache by default for DNS resolution
prepend domain-name-servers 127.0.0.1 ;
_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com
_______________________________________________
Leaf-user mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
