Linux-Networking Digest #59, Volume #11 Thu, 6 May 99 10:13:33 EDT
Contents:
VPN and Masquerading problem Help needed (Masher)
Re: W98 can ping Linux; Linux can't ping W98?? ("Curt")
Masq. Problem : Win95<=>RH 5.2 network (Oliver Saal - 376143)
Re: procmail (or sendmail?) problems (mist)
Re: PPP - Please no ppp how-to's (Lew Pitcher)
Re: Connect to Oracle from Linux ("Ian Lunam")
Re: no pingies in very simple network (Luca Filipozzi)
Re: port forwarding in 2.2.x ("Ronny Adsetts")
Mapping Win98 drive letters to Linux server? ("Dave Ewart")
Re: Simple Network Question (J. L. Stolm)
Re: Crontab woes with RH5.2 ([EMAIL PROTECTED])
Re: Simple Network Question (Lew Pitcher)
Simple Network Question (Arthur Merar)
Re: Routing and router redundancy ("Curt")
Debian Firewall Questions (Fraser Campbell)
Re: no pingies in very simple network ([EMAIL PROTECTED])
Re: Setting Linux up to pass thru Wingate proxy ("Pic")
error messages on kernel 2.2.5 from RedHat 6 (Mark Lo)
----------------------------------------------------------------------------
From: (Masher)
Subject: VPN and Masquerading problem Help needed
Date: Thu, 06 May 1999 10:04:02 GMT
I have linux 2.0.36
IP masquerading in kernel
test system is such
A ----------A1|----| X1 - - - - - - - - - -X2 |---|B1---------b
A is host on private Ip net of X.X.2.0
A1 is default gateway of machines on A's net
X1 is external eth0
X2 is remote Linux box
B1 is default gateway of machines on B's network
B is host on private net X.X.3.0
Private net refers to non routable private IP's
X Ips are public IP's
masquerading rules on both machines are
-F -p deny
-F -a m -S x.x.2.0/24 -D 0.0.0.0/0
or
-F -a m -S x.x.3.0/24 -D 0.0.0.0/0
plus other rules
everything works fine
but cannot ping the other private network so need a VPN
using the tunneling biult into the kernel
with a virtual subnet of x.x.5.0
so At machine with externel interface X1
have
ifconfig tunl0 X.X.5.2 netmask 255.255.255.0 pointopoint X2 up
routes are:
route add -host X2 netmask X.X.X.X gw <next router> dev eth0
route add -net X.X.3.0 netmask 255.255.255.0 dev tunl0
route add -net X.X.5.0 netmask 255.255.255.0 gw X.X.5.3 dev tunl0
also added rules to firewall before generic masquerading
-F -a accept -S X.X.2.0/24 -D X.X.3.0/24
-F -a accept -S X.X.3.0/24 -D X.X.2.0/24
-F -a accept -S X1/32 -D X2/32
-F -a accept -S X2/32 -D X1/32
-F -a accept -S X.X.5.2/32 -D X.X.5.3/32
-F -a accept -S X.X.5.3/32 -D X.X.5.2/32
then the generic masquerading rule
After this is done from both machines can ping X1, X2 X.X.5.2 and
X.X.5.3
ie. both normal external interfaces and each end of the tunnel
but when try to ping X.X.3.x which is behind the other masqueraded
machine
get nothing
a tcpdump does not show any activity
this is a simple test vpn of ipip so nothing to do with encryption
etc.
Any ideas
Thanks
------------------------------
Reply-To: "Curt" <[EMAIL PROTECTED]>
From: "Curt" <[EMAIL PROTECTED]>
Subject: Re: W98 can ping Linux; Linux can't ping W98??
Date: Thu, 6 May 1999 06:20:32 -0500
Well you don't really need a host route UH. A route to the 192.168.1.0 net
should be sufficient (unless you have aliased interfaces).
Now it seems odd that the MSS in 0. I would expect it to be 1500 for eth0
and 3584 for lo.
Mark Larimer <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Sure...here you go.
>
> [larimer@quazi larimer]$ netstat -nr
> Kernel IP routing table
> Destination Gateway Genmask Flags MSS Window irtt
> Iface
> 192.168.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
> 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
> 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
>
> Let me know if you see anything fishy in here. Thanks...
> --mark
>
> Curt wrote:
> >
> > Can you post the result of netstat -nr ? Do you have a route to the
local
> > net?
> >
> > Also I noticed the MTU on your loopback address is 3924. This usually
is
> > 3584.
> > I don't know that this would cause any problem though.
>
> **********************************************************
> *** FantasyBowl.com Play Fantasy Football ***
> *** http://fantasybowl.com 1999 Grand Opening! ***
> *** ***
> *** Mark D. Larimer ***
> *** [EMAIL PROTECTED] (651) 645-5623 ***
> **********************************************************
------------------------------
From: Oliver Saal - 376143 <[EMAIL PROTECTED]>
Subject: Masq. Problem : Win95<=>RH 5.2 network
Date: Thu, 06 May 1999 13:16:24 +0200
Basically, I am busy setting a masquerading Linux machine ("kenny" )
hiding a number of other machine behind it. The other machines happen to
be a Win95 machines ( only 1 at the moment ).
My problem : I have two NIC's
one for the external CS domain : eth0 (137.158. ...)
one for the internal masq domain : eth1 (192.168.0...)
>From the Linux box, I can ping other machines on the CS domain.
>From the Win95 machine, I cannot ping anything on the internal network.
Closer analysis revealed, when the Win95 pinged the Linux box, the Linux
box incremented the errors by the number of ping requests. However the
pings eventually timed out.
Any ideas, do I have to explicitly set up routes and gateways in Win95,
or did I miss something ?
--
==============================================================
Oliver Saal Dept. of Computer Science
Tel:+27-21-6502670 University of Cape Town
http://www.cs.uct.ac.za/~osaal University-based web page
==============================================================
------------------------------
From: mist <[EMAIL PROTECTED]>
Subject: Re: procmail (or sendmail?) problems
Date: Thu, 6 May 1999 12:50:47 +0100
Reply-To: mist <new$[EMAIL PROTECTED]>
Juergen Fiedler <[EMAIL PROTECTED]> scribed to us that -
>Hi,
<snip>
>If I watch /var/log/messages directly after invoking procmail,
>I see the following:
>
>>-------SNIP-------<
>May 5 18:07:31 CaveMaus sendmail[4177]: SAA04177: from=juergen,
>size=44757, class=-60, pri=182757, nrcpts=1,
>msgid=<[EMAIL PROTECTED]>, relay=root@localhost
>>-------SNIP-------<
>
>This line is repeated several times (once for every mail in
>/var/spool/mail/all, I guess) Funnily enough, even the msgid
>is the same each time (happens to be the first one in the mail
>file). Could I have a sendmail problem? I copied the old
>sendmail.cf directly from my old system.
I think that it's more likely to be a mailer problem, as there is no
corresponding "to" line which would indicate successful transfer. What
you see in that message is the logging by Sendmail of a mail destined
for one of your local users, but to go along with it there should be a
line with "to" in it somewhere, and the recipient name. Perhaps when
you changed your local mailer it wasn't quite set up properly, or the
config files don't agree with where the programs are now.
--
Mist.
------------------------------
From: [EMAIL PROTECTED] (Lew Pitcher)
Subject: Re: PPP - Please no ppp how-to's
Reply-To: [EMAIL PROTECTED]
Date: Thu, 06 May 1999 12:01:05 GMT
On Wed, 5 May 1999 17:22:13 +1000, "The Pike's" <[EMAIL PROTECTED]> wrote:
>The question I am asking is probably the most common asked on the face of
>the planet. Does anyone have a txt file on setting up ppp? The so-called
>PPP-How To's are so useless I dont think that it was worth the hard drive
>space. I am in Red Hat and really want to know the answer of this. I once
>got a file that was very easy, it was a small, 20k txt file on it. It
>worked sweet, but then I had to reformat... Please help, I know this is a
>very common problem but I really want to knoow this answer to this. If you
>could please reply to this I will be very thankful.
Dan, the answer is *no*.
There is no 'small text' file on how to set up PPP
RTFM
Lew Pitcher
System Consultant, Integration Solutions Architecture
Toronto Dominion Bank
([EMAIL PROTECTED])
(Opinions expressed are my own, not my employer's.)
------------------------------
From: "Ian Lunam" <[EMAIL PROTECTED]>
Subject: Re: Connect to Oracle from Linux
Date: Thu, 6 May 1999 09:27:08 +1200
What you need is SQL*Net for Linux from Oracle.
At present the only way I know to get it is by downloading the full Oracle
set from http://technet.oracle.com but that's about a 167Meg download.
Ian
[EMAIL PROTECTED] wrote in message <7gqa9e$7lq$[EMAIL PROTECTED]>...
>I need to connect to a Oracle database (in a Sun box) from my Redhat Linux
>box. Please tell me what I need and where to get it. Thank you!
>
>-----------== Posted via Deja News, The Discussion Network ==----------
>http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: [EMAIL PROTECTED] (Luca Filipozzi)
Subject: Re: no pingies in very simple network
Date: Thu, 6 May 1999 01:03:02 -0700
In article <7grgn6$9hr$[EMAIL PROTECTED]>, [EMAIL PROTECTED]
says...
> In article <7gremp$6r4$[EMAIL PROTECTED]>,
> [EMAIL PROTECTED] wrote:
>
> > Kernel IP routing table
> > Destination Gateway Genmask Flags Metric Ref Use
> > Iface
> > 192.168.0.0 * 255.255.255.0 U 0 0 1
> > eth0
> > localhost * 255.0.0.0 U 0 0 5
>
> Woah... that's not right.
>
> It's supposed to have an IP or MAC address in the "Gateway" field, not '*'.
If you type "route", then the asterixes (asterii??) will show up.
If you type "route -n" (do not resolve ip address to names), then you get
0.0.0.0 as you would expect.
> Add in the routes like this:
>
> `route add default 192.168.0.1`
In a two machine network, you don't have to specify the other machine or
your local interface as the default gateway. There is *no* default
gateway. All you need is
route add -net 192.168.0.0 netmask 255.255.255.0
route add -net 127.0.0.0 netmaks 255.0.0.0
which he apparently already has.
> ...and *not* like this:
>
> `route add default eth0`
Yes, this would definitely be wrong.
>
> ..because that doesn't make any sense [unless it's *completely* different on
> Linux than it is on FreeBSD].
Luca
--
Luca Filipozzi <[EMAIL PROTECTED]>
------------------------------
From: "Ronny Adsetts" <[EMAIL PROTECTED]>
Subject: Re: port forwarding in 2.2.x
Date: Thu, 6 May 1999 13:11:00 +0100
Try http://www.rustcorp.com/linux/ipchains/
... and the man pages :)
TTFN,
Ronny Adsetts
[EMAIL PROTECTED] wrote in message <[EMAIL PROTECTED]>...
>hi everyone !!
>
>i'm searching for some documentation and/or experience with the port
>forwarding features in the current linux kernels.
>
>i had a look at IPPORTFW and MARKFW but could find any documentation
>how to setup and use these features.
>
>if any one knows a link or has some more information on these topics,
>please send me a mail
>
>TIA,
>
>olli
>
>
------------------------------
From: "Dave Ewart" <[EMAIL PROTECTED]>
Subject: Mapping Win98 drive letters to Linux server?
Date: Thu, 6 May 1999 13:14:23 +0100
I have a network of PCs running Windows 98 - we have a handful of Netware
3.12 servers.
I have successfully configured a Linux (RedHat 5.2) server to be able to
"see" the files on the Netware servers, using the IPX setup in LinuxConf and
the command "ncpmount". This works fine.
What I would like to do, however, is to map a drive letter on the Windows 98
workstations to a specified point on the Linux box. How do I do that? Is
it possible? [The workstations are using the Novell Netware Client 3.10 to
access the Netware servers.]
Thanks for any tips,
Dave.
--
Dave Ewart, Computing Manager
Imperial Cancer Research Fund (Cancer Epidemiology Unit), Oxford
[EMAIL PROTECTED]
------------------------------
From: J. L. Stolm <[EMAIL PROTECTED]>
Subject: Re: Simple Network Question
Date: Thu, 06 May 1999 12:14:18 GMT
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (Arthur Merar) wrote:
> I also want to be able the see the Linux box from my Windows box so I
> can telnet in and FTP to and from it.
> What do I need to make all this possible? Any help would be
> appreciated.
> [EMAIL PROTECTED]
You will need to recompile your Linux kernel to include IP spoofing, then
you need to setup diald on the linux box.
For detailed information, I highly recommend the book, "Linux Network
Toolkit" by Paul G. Sery -- it has step by step instructions for setting
up what you want; the only bad part is that the books works from a Red Hat
5.0 viewpoint, so some part may be slightly different depending on your
setup (although a CD is included that has RH5 on it).
--
J. L. Stolm -- [EMAIL PROTECTED] // Resident of North Carolina
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Crontab woes with RH5.2
Date: Thu, 06 May 1999 12:05:07 GMT
In article <[EMAIL PROTECTED]>,
"Leopold Toetsch" <[EMAIL PROTECTED]> wrote:
> Dear Mr. Bill
>
> First do something like this
> > ls -l /bin/sh bin/bash:
>
> -rwxr-xr-x 1 root root 475092 Dec 13 22:52 bash
> lrwxrwxrwx 1 root root 4 Feb 1 20:12 sh -> bash
> (this it gives for me)
Yes, the RH box I just checked has it the same way. Now I don't know whether
to feel silly for changing my shell on every Linux box I've set up [since it
now seems that was a waste of time], or pissed off that RH [at least] would
do something so stupid. First off, bash and sh are *not* the same thing.
Secondly, bash is a dynamically linked executable, and root's shell is *not*
supposed to be dynamically linked [okay, okay, I always change it to bash
anyway, but it really *shouldn't* be anything other than /bin/sh or /bin/ksh
by default].
> 2. Read the bash reference manual oder the infopages:
>
> export [-fn] [-p] [name[=value]]
Yes, I am well aware of the format of the export command. The bourne shell
has a different syntax, namely that which I mentioned previously. Backwards
compatibility with the bourne shell is why most installations of bash have a
default .profile [or .bashrc] with the export on a second line.
> 3. Then please answer again
What I posted is correct for every UNIX-derived OS on the planet except
Linux. This is, however, a Linux newsgroup. In light of that, I'll change my
previous statement from "that will not work" to "that's not a good idea".
It's always a good habit to do things the "right" [ie portable] way, RH's
[mis-]configuration notwithstanding.
-Bill Clark
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: [EMAIL PROTECTED] (Lew Pitcher)
Subject: Re: Simple Network Question
Reply-To: [EMAIL PROTECTED]
Date: Thu, 06 May 1999 12:26:49 GMT
Well, how do you like reading??
You are going to need...
a) a NIC from the Linux Hardware Compatability list (or equivalent)
b) a Linux kernel gen'ed with Ethernet and TCP/IP support, including...
- hardware support for your NIC
- IP Forwarding
- IP Masquerading
c) a number of the HOWTOs. Try...
- Kernel-HOWTO
- Ethernet-HOWTO
- NET-3-HOWTO
- PPP-HOWTO
d) a bit of patience (it takes a little effort to understand the concepts,
and a little more effort to set up the requisite parameters, scripts, etc.)
On Thu, 06 May 1999 11:21:20 GMT, [EMAIL PROTECTED] (Arthur Merar) wrote:
>
>Hello,
>
>I am fairly new to Linux. I just got Red Hat and I am going to take a
>Pentium 233 that I have and install Linux on it. I want to put a NIC
>in it and hook it to my hub and make it so my Windows box dials out
>through the Linux box.
>
>I also want to be able the see the Linux box from my Windows box so I
>can telnet in and FTP to and from it.
>
>What do I need to make all this possible? Any help would be
>appreciated.
>
>Thanks,
>
>Please send a copy to e-mail.
>
>Arthur
>[EMAIL PROTECTED]
>
Lew Pitcher
System Consultant, Integration Solutions Architecture
Toronto Dominion Bank
([EMAIL PROTECTED])
(Opinions expressed are my own, not my employer's.)
------------------------------
From: [EMAIL PROTECTED] (Arthur Merar)
Subject: Simple Network Question
Date: Thu, 06 May 1999 11:21:20 GMT
Hello,
I am fairly new to Linux. I just got Red Hat and I am going to take a
Pentium 233 that I have and install Linux on it. I want to put a NIC
in it and hook it to my hub and make it so my Windows box dials out
through the Linux box.
I also want to be able the see the Linux box from my Windows box so I
can telnet in and FTP to and from it.
What do I need to make all this possible? Any help would be
appreciated.
Thanks,
Please send a copy to e-mail.
Arthur
[EMAIL PROTECTED]
------------------------------
Reply-To: "Curt" <[EMAIL PROTECTED]>
From: "Curt" <[EMAIL PROTECTED]>
Subject: Re: Routing and router redundancy
Date: Thu, 6 May 1999 07:25:24 -0500
While linux is quite reliable, you might consider the use of switches
instead of hubs. A switch would probably be more reliable and acheive your
objective. Unless you have more than 253 hosts.
Mark <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> I currently have a 10Mbs network and I am considering moving some of the
> systems that generate the heaviest traffic to a 100Mbs segment.
>
> I am considering doing this using Linux and ip forwarding to route packets
> appropriately between the two segments.
>
> i.e.
> eth0 - 10Mbs segment - 192.168.255.0
> eth1 - 100Mbs segment - 192.168.254.0
>
> However, in such a setup the router has to be extremely reliable, if the
> router should fail (hardware failure, naturally) then the two subnetworks
> would become invisible to each other, this is not an acceptable solution.
>
> How could I implement a secondary (backup) router into such a scheme to
allow
> some redundancy and how would I set up and configure such a system.
>
> Thanks for any suggestions
>
>
>
> Mark Garner
------------------------------
From: Fraser Campbell <[EMAIL PROTECTED]>
Subject: Debian Firewall Questions
Date: Thu, 06 May 1999 13:59:56 GMT
I recently set up a firewall for a customer using slink and kernel
2.2.3. I just want to verify that the setup is secure. I have read
through the Firewall HOWTO but it hasn't been updated since 1996 and
doesn't reflect the software I am using now ... so I ask here.
eth0: 1.2.3.4 (external interface)
eth1: 192.168.1.1 (internal interface)
The server has been running great without reboot for over a month and
everyone is very happy. The internal LAN consists of Windows (3.1, 95,
98 and NT), Novell, DOS and Linux machines.
Over the weekend the LAN administrator had some Novell accounts
disappear from one of the internal servers. He asked if someone could
have come through the firewall and done it. I find it doubtful but
thought I should ask people more knowledgeable than myself.
There is no running inetd. netstat -a show this:
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State
raw 0 0 *:1 *:*
raw 0 0 *:6 *:*
Active UNIX domain sockets (including servers)
unix 1 [ ] STREAM CONNECTED 22313 @00000011
unix 1 [ ] STREAM CONNECTED 35 @00000002
unix 1 [ ] STREAM CONNECTED 29 @00000001
unix 0 [ ACC ] STREAM LISTENING 26 /dev/log
unix 1 [ ] STREAM CONNECTED 22314 /dev/log
unix 1 [ ] STREAM CONNECTED 36 /dev/log
unix 1 [ ] STREAM CONNECTED 30 /dev/log
I am using kernel 2.2.3 (soon to be 2.2.5) and ipchains. My ipchains
rules are as follows:
ipchains -P forward DENY
ipchains -A forward -j MASQ -s 192.168.1.0/24 -d 0.0.0.0/0
which listing chains give:
Chain input (policy ACCEPT):
Chain forward (policy DENY):
target prot opt source destination
ports
MASQ all ------ 192.168.1.0/24 anywhere n/a
Chain output (policy ACCEPT):
How secure is this setup? Is there any way for people on the Internet
to come through and connect to internal hosts?
Also, I have installed ipac in the hope that I can monitor connection
attempts from outside our network. Does the slink ipac package work with
ipchains and kernel 2.2.x?
Thanks for your time and any assistance!
Fraser
P.S. This message was originally posted to debian-isp and debian-user. I
did not get any useful feedback there so I'll try here now. Please copy
responses to me by email ... it is difficult for me to access news. I will
respond to the group(s) if appropriate.
P.P.S. Please don't tell me to upgrade to 2.2.7. I am aware of the
vulnerabilities in 2.2.3 and will upgrade shortly.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: no pingies in very simple network
Date: Thu, 06 May 1999 13:05:03 GMT
In article <[EMAIL PROTECTED]>,
Rob van der Putten <[EMAIL PROTECTED]> wrote:
> Hi there
>
> Can you ping yourself (192.168.0.1)?
> Did you set the media type to auto detect or fixed (either Coax + BNC or
> UTP)?
>
> Regards,
> Rob
Yes, I can ping myself and the NIC is only UTP (one of those cheap 3com
specials).
Dennis
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: "Pic" <[EMAIL PROTECTED]>
Subject: Re: Setting Linux up to pass thru Wingate proxy
Date: Thu, 6 May 1999 10:06:39 -0400
Replace Wingate 3.x with a combination of Squid-2.2 and ip-masquerade.
You will greatly improve the performance and won't need an over priced
license!
We just done that in our shop and we couldn't be happier...
Regards
<[EMAIL PROTECTED]> wrote in message 7gql5r$hjk$[EMAIL PROTECTED]
>I have been baning my head on this one.
>
> I am new to linux. I do have a little networking background. But every
>article I find regarding this problem seems to not relate to what I am
>looking for.
>
> Basicly this is what I need to know.
>
> I am running Wingate 3.0 on a win98 machine. I recenlty put linux on my
>other machine. I am trying to set linux up so that it can access the
internet
>thru the wingate server. But I can't seem to even find out where to start.
>
> So far I have managed to get my ethernet card detected using eexpress.c.
>That was the EASY part. lol. I have read NET-3.HOWTO . No help there.
>
> Can someone please post a reply with some possible suggestions?
>
>
> Thanks,
>
> Mike Swearingen
>
> FYI - I am running Suse 2.2.5 if it matters.
>
>-----------== Posted via Deja News, The Discussion Network ==----------
>http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: Mark Lo <[EMAIL PROTECTED]>
Crossposted-To: comp.os.linux.setup
Subject: error messages on kernel 2.2.5 from RedHat 6
Date: Thu, 06 May 1999 22:14:23 +0800
Hi! I upgraded my RedHat 5.2 kernel by some RedHat 6 rpm files.
I installed some packages including modutils, net-tools,...
When reboot, error messages for nic driver,
modprob: no dependency infomation for module:
"/lib/modules/2.2.5-15/net/tulip.o"
eth0: unknown interface: No such device
SIOCADDRT: No such device
so, what package did I miss? Thanks...
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and comp.os.linux.networking) via:
Internet: [EMAIL PROTECTED]
Linux may be obtained via one of these FTP sites:
ftp.funet.fi pub/Linux
tsx-11.mit.edu pub/linux
sunsite.unc.edu pub/Linux
End of Linux-Networking Digest
******************************
