IP routing help with two inside / one outside network

[pau1knopp]

I have a KNOPPIX server (running from CD) with network connections configured as follows:

internet (ppp) outside interface DHCP
eth0 (LAN) inside interface (192.168.1.1)
eth1 (WLAN) inside interface (10.0.1.1)

eth0 serves up DHCP and NAT for the 192.168.1.0 network (via KNOPPIX terminal services) and works great as an internet gate way for the 192.168.1.0 network.

My desktop workstations on the LAN can obtain a IP address from the DHCP interface and can ping anything on the 192.168.1.0 network, but cannot ping anything on the 10.0.1.0 network.

My laptop on the WLAN is manually configured for IP address 10.0.1.2 and can ping the servers 10.0.1.1 interface, but cannot ping anything on the 192.168.1.0 network.

I would like to have connectivity between the two. Eventually I will want them both to be able to be able to use the ppp / NAT connection for internet connectivity, but for right now I just need to get them talking to each other.

Any help would be greatly appreciated.

Regards,

Paul

[gowator]

Im doing exactly the same except with a HDD install and eth0 and eth1 swapped.

ITs working right now

Heres my setup, switch eth0 and eth1 for you
I set it via webmin but with this as reference you should get it working


Chain OUTPUT (policy DROP)
target root@lepeanuts:~# more /var/lib/iptables/active
# Generated by iptables-save v1.2.9 on Sun Feb 1 20:05:07 2004
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Sun Feb 1 20:05:07 2004
# Generated by iptables-save v1.2.9 on Sun Feb 1 20:05:07 2004
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.0.0/255.255.0.0 -j MASQUERADE
COMMIT
# Completed on Sun Feb 1 20:05:07 2004
# Generated by iptables-save v1.2.9 on Sun Feb 1 20:05:07 2004
*mangle
:PREROUTING ACCEPT [1232:98033]
:INPUT ACCEPT [1222:97427]
:FORWARD ACCEPT [10:606]
:OUTPUT ACCEPT [1232:98313]
:POSTROUTING ACCEPT [1232:98033]
uttos - [0:0]
retos - [0:0]
-A PREROUTING -j pretos
-A OUTPUT -j outtos
-A outtos -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 21 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 20 -j TOS --set-tos 0x08
-A outtos -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08
-A pretos -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 21 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 20 -j TOS --set-tos 0x08
-A pretos -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08
COMMIT
# Completed on Sun Feb 1 20:05:07 2004
prot opt source destination
ACCEPT all -- anywhere anywhere

Then you need to setup masquerading

[gowator]

Then you need to supply IP's Im using DHCP for the internal LAN and the wireless.

Heres /etc/dhcp3/dhcpd.conf

root@lepeanuts:~# cat /etc/dhcp3/dhcpd.conf
option domain-name "lepeanuts.homelinux.com";
option domain-name-servers 80.10.246.130 , 80.10.246.3;
# lepeanuts
subnet 192.168.2.0 netmask 255.255.255.0 {
        option domain-name-servers 80.10.246.130 , 80.10.246.3;
        option routers 192.168.2.1;
        option domain-name "lepeanuts.homelinux.com";
        range 192.168.2.20 192.168.2.50;
        allow unknown-clients;
        }
# WiFi Interface
subnet 192.168.0.0 netmask 255.255.255.0 {
        option domain-name-servers 80.10.246.130 , 80.10.246.3;
        option domain-name "lepeanuts.homelinux.com";
        option routers 192.168.0.1;
        range 192.168.0.20 192.168.0.50;
        }
allow unknown-clients;

And you need the bind setup to resolve DNS and forward default routes

root@lepeanuts:/etc/bind# more named.conf

include "/etc/bind/named.conf.options";

// prime the server with knowledge of the root servers
zone "." {
        type hint;
        file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};

zone "com" { type delegation-only; };
zone "net" { type delegation-only; };



include "/etc/bind/named.conf.local";
zone "lepeanuts.homelinux.com" {
        type master;
        file "/var/cache/bind/lepeanuts.homelinux.com.hosts";
        };

root@lepeanuts:/etc/bind# more named.conf.options
options {
        directory "/var/cache/bind";

 
        auth-nxdomain no;    # conform to RFC1035

        listen-on {
                127.0.0.1;192.168.2.1;
                };
};

[gowator]

Does this answer the question ???

[pau1knopp]

I was hoping for a solution using the route command, as webmin is not installed on the CD. Since *everything* is working for the one inside network (192.168.1.0) all I really need is something to bring the 2nd inside network (10.0.1.0) into the picture.

Thanks in advance for any help this group may be able to provide.

Regards,

Paul

[gowator]

The problem is you need to also export that route.
you can add the 10.0.1.0 network to the route so it can access this network but you also need to recipricate that on the other network...

you could add
route add 10.0.1.0 netmask 255.255.255.0 eth1 on the server
and on each client you could add

route add default gw 10.0.1.0
however you then need the wireless application box to route across the two. With a hardware box it does this for you using NAT,

I think IP tables is on the liveCD so you could try a script to add my stuff into IP tables.... a look through man IPTABLES should give you the syntax.
(unless you setup DHCP and BIND though you will have to set up each client by hand.....)

BTW this is actually working right now... and I guess its what you actually wanna do!!!