Re: [Masq] ping does not return....

[Hajime Lucky Okada]

/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ raf, Thank you very much indeed! raf wrote: > > make sure that you have configured the kernel to masquerade icmp packets > since it doesn't by default (the option is called something like > MASQUERADE_ICMP). Yes, this was OK! (CONFIG_IP_MASQUERADE_ICMP) > if that's not the problem, go to > http://www.zip.com.au/~raf2/lib/software/firewall > there's a utility in there called fwhelper which > simulates the packet matching algorithm and shows > a trace so you can see what rules match or not and > why or why not. it's like "ipchains -C" but useful. > > > Another thing, how can I do logging packets rejected by "DENY POLICY"? > > make the last rule on the chain do nothing but log. > e.g. > ipchains -A input -l > ipchains -A output -l This information was very useful. Thanks to you, I could discover my fatal and very stupid error. Though IP address of firewall was A.B.C.1, I described (A-1).B.C.1 . I could found it with the syslog generated above rule. The ping finally can be passed between HOST-WWW and HOST-1. Still there is a little problem about ftp, so I will try to use the tool "fwhelper" you introduced me for it. > also, it looks like the firewall/masquerading host will masquerade > any packets that it receives via eth1 that need to be forwarded via > eth2 or vice versa. this is probably a mistake. do something like > the following to prevent this: > > # Accept (unmasqueraded) traffic amongst multiple internal networks > > for src in $INTERNAL_NETWORKS > do > for dst in $INTERNAL_NETWORKS > do > if [ "$src" != "$dst" ] > then > ipchains -A forward -s $src -d $dst -j ACCEPT > fi > done > done > > # Masquerade traffic from internal networks to the outside world > > for masqnet in $INTERNAL_NETWORKS > do > ipchains -A forward -s $masqnet -j MASQ > done About this, I have to add explanation. To say exactly, I settle a data base host protected by firewall on the another network "eth1", that functions passively. On HOST-F/W, I have HOST-1 to be able to access to both of HOST-WWW thru eth0 and data base host thru et0. The HOST-WWW and data base host only reply for this access from HOST-1, principally. When this access from HOST-1, the ip address would be masquerade to eth0 (to HOST-WWW) or to eth1 (to data base host). In this moment, the data base host will not access to another host by itself. In very near future, the HOST-WWW should access to the data base host to serve it's data on Web. For this, I will allow it by applying rules of port forwarding 'ipmasqadm' on HOST-F/W from eth0 to eth1, because the access should be very limited. So, I think it would not be so necessary for applying above scripts for this schematic, what dp you think? Anyhow, thanks again ! Jaime. PS: Is there no way to receive these message in each... (not digest version) ??? -- Hajime Lucky Okada Email) [EMAIL PROTECTED] <HOME> http://www2.osk.3web.ne.jp/~luckyo/ _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.