Peter,<br>I understand that pert. Currently we have netscreen 5Gt firewall and that is working perfect. We need to change that because that support only 15 SIP Sessions. <br>In our current setup<br>Internet <----> Netscreen 5Gt <--------> Our Switch <---> our servers with the default gateway provided by our service provider.
<br><br>Netscreen is configured in transparent mode. <br><br>So my question is can I use Linux in the same way. <br><br>2nd question was I ask my SP to change the routing for us, which is not an issue. Will choosing Linux will be better choice over cisco firewall in the long run. What will be porns and cons of Linux vs Cisco.
<br><br><br>-Jai<br><br><div><span class="gmail_quote">On 10/5/07, <b class="gmail_sendername">Peter McGill</b> <<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Switching to something else than your current
hardware/os/software will not change things.<br>The problem you have is with
basic tcp/ip routing, this is the same no matter what hard/software you
use.<br>You must get you isp to route traffic to your gateway or gateways as I
said before.</font></span></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">To explain in more detail.</font></span></div>
<div><span><font color="#0000ff" face="Arial" size="2">Ask
your isp to add the following route to their router
(<a href="http://216.209.3.193" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.193</a>):<br>Destination: <a href="http://216.209.3.192/26" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
216.209.3.192/26</a><br>Gateway:
<a href="http://206.216.3.212" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">206.216.3.212</a></font></span></div>
<div><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div><span><font color="#0000ff" face="Arial" size="2">Once
this is done, all traffic returning from the internet will use your internal
routes via .212,</font></span></div>
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>and this will fix your traffic flow. It's that easy,
now you just need to convince your isp, which if
they're</span></font></font></font></div>
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>any good should not be difficult. Then just make sure
.212 has appropriate routes for all subnets.</span></font></font></font></div>
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>You may also need to reconfigure your computers on
.192/27 to use .212 as their internet gateway.</span></font></font></font></div>
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>ie)</span></font></font></font></div><font><font size="2"><font color="#0000ff"><span>
<div><font size="2"><font color="#0000ff" face="Arial"><span>Destination:
<a href="http://216.209.3.192/27" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.192/27</a></span></font></font></div>
<div><font size="2"><font color="#0000ff" face="Arial"><span>Gateway: <a href="http://216.209.3.212" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.212</a>
(eth0)</span></font></font></div>
<div><font face="Arial">Destination: <a href="http://216.209.3.224/28" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.224/28</a></font></div>
<div></div></span></font></font></font><span><font color="#0000ff" face="Arial" size="2">Gateway: <a href="http://216.209.3.225" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.225</a> (eth1)
</font></span></div><span>
<div dir="ltr" align="left"><font face="Arial">
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>Destination:
<a href="http://216.209.3.240/28" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">216.209.3.240/28</a></span></font></font></font></div>
<div><font face="Arial"><font size="2"><font color="#0000ff"><span>Gateway: ? ?
(unallocated?)</span></font></font></font></div><br><font color="#0000ff" size="2"></font></font></div></span>
<div><font color="#0000ff" face="Arial" size="2"></font> </div>
<div align="left"><font face="Arial" size="2">Peter McGill</font></div>
<div> </div><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><span class="q"><b>From:</b> Jai Rangi [mailto:<a href="mailto:jprangi@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">jprangi@gmail.com</a>]
<br></span><b>Sent:</b> October 5, 2007 3:25 PM</font><div><span class="e" id="q_11571c8e85a6c818_3"><font face="Tahoma" size="2"><br><b>To:</b>
<a href="mailto:petermcgill@goco.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">petermcgill@goco.net</a><br><b>Cc:</b> <a href="mailto:users@openswan.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
users@openswan.org</a><br><b>Subject:</b> Re:
[Openswan Users] Firewall,Routing and Tunneling between public
networks<br></font></span></div><br></div><div><span class="e" id="q_11571c8e85a6c818_5">
<div></div>Peter, <br>I think this is the case and this is what I have been
wondering all the time. <br><span><font color="#0000ff" face="Arial" size="2">" But
your ISP router might not be forwarding to your internal subnet gateways
correctly thinking you have just one large subnet that they've assigned you.
"<br><br><span style="color: rgb(0, 0, 0);">Now considering my ISP thinks that we
have just one large subnet. Can I use Linux box and put in front my my whole
network and this linux box just act like a firewall and we setup our IPSec
tunneling with one provider and let the traffic pass through for others.
</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Traffic
comes in eth0, goes out to a switch for my network. Traffic come on eth1 from
the switch and goes out to eth0 to the internet. </span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">I need another suggestion between linux/racoon/ipsec
solution VS buying a cisco or Juniper's firewall. </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">We are a voip
company so uptime of this firewall/tunnel is very very important. Should we go
with Linux/Racoon solution or should we buy cisco solution more expensive.
</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Is racoon mature enough that we configure it once
and than we just forget about that assuming that it will never break.
</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Thank you,</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">-Jai</span><br></font></span>
<br>
<div><span class="gmail_quote">On 10/4/07, <b class="gmail_sendername">Peter
McGill</b> <<a href="mailto:petermcgill@goco.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">petermcgill@goco.net</a>> wrote:</span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Ok, so
if all your internal communication with your various subnets is working and
the only thing lacking is internet communication.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">It may
be your ISP router. Since your subdividing the subnet given by your ISP, all
traffic should get to your ISP router, no problem there.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">But your
ISP router might not be forwarding to your internal subnet gateways
correctly thinking you have just one large subnet that they've assigned
you.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">I
suggest either telling your ISP about your subletting scheme with gateways
so they can correctly forward inbound traffic to your subnet
gateways,</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">or else
ask them to forward all traffic to a single machine that you control
that is directly connected to the ISP router.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Then
setup the routing on that machine to forward all your internal traffic
correctly. The first option results in less router hops/network delay,
but</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">the
second option allows you to more easily reconfigure your internal subnets
without contacting your ISP.</font></span></div>
<div> </div>
<div align="left"><font face="Arial" size="2">Peter McGill</font></div>
<div> </div><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><span><b>From:</b> Jai Rangi
[mailto:<a>jprangi@gmail.com</a>] <br></span><b>Sent:</b> October 4, 2007
1:08 AM
<div><span><font color="#0000ff" face="Arial"></font><font color="#0000ff" face="Arial"></font><br><b>To:</b>
<a>petermcgill@goco.net</a><br><b>Cc:</b>
<a>users@openswan.org</a><br><b>Subject:</b> Re: [Openswan Users]
Firewall,Routing and Tunneling between public
networks<br></span></div></font><br></div>
<div><span>
<div></div>Peter, <br>Thank you for looking in this. <br>
<div dir="ltr" align="left"><span style="color: rgb(0, 0, 0);"><font face="Arial" size="2">I restarted my machine and now I am able to ping from
<a>216.209.3.192/27</a> network, if I define the routing table. In another
server <a>216.209.3.201</a>, I add the rule in the routing table.
<br><span style="font-weight: bold;"><a>206.216.3.224</a>
</span></font><font style="font-weight: bold;" face="Arial" size="2">206.216.3</font><font face="Arial" size="2"><span style="font-weight: bold;">.212 <a>255.255.255.240
</a>UG 0
0 0 eth0</span><br></font><font face="Arial" size="2">206.216.3</font><font face="Arial" size="2">.192
*
<a>255.255.255.192</a> U
0
0 0 eth0
<br><a>192.168.2.0</a>
*
<a>255.255.255.0</a> U
0
0 0
eth1<br><a>192.168.1.0</a>
*
<a>255.255.255.0</a> U
0
0 0
eth1<br><a>169.254.0.0</a>
*
<a>255.255.0.0</a> U
0
0 0
eth1<br>default
</font><font face="Arial" size="2">206.216.3</font><font face="Arial" size="2">.193
<a>0.0.0.0</a>
UG 0
0 0 eth0<br><br>I can ping
<a>216.209.3.235</a> from <a>216.209.2.201</a> and vise versa<br><br><span style="color: rgb(0, 0, 0);">Internet router <--->
(</span></font><font style="color: rgb(0, 0, 0);" face="Arial" size="2"><a>
206.216.3.192/26</a> network and router is one of them </font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">206.216.3</font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">.212) </font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">
<a>206.216.3.224/28</a> is
behind the router. <br>So this works. <br></font><font style="color: rgb(0, 0, 0);" face="Arial" size="2"><a>206.216.3.201</a>
---- router </font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">206.216.3212 (eth0) </font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">206.216.3.225(eth1) ----- </font><font style="color: rgb(0, 0, 0);" face="Arial" size="2">
206.216.3.224.235 with gateway
<a>216.209.3.225</a></font></span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"><font face="Arial" size="2"><br>But when I try ping
something on internet from </font></span><span><font color="#0000ff" face="Arial" size="2"><span style="color: rgb(0, 0, 0);"><a>206.216.3.235</a>.
Seems the traffic goes out but does not find the way to come back. This is
what I get from tcpdump on my router.. </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">[root@bser2
sysconfig]# tcpdump | grep "235\|158"</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">tcpdump: verbose
output suppressed, use -v or -vv for full protocol decode </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">listening on
eth0, link-type EN10MB (Ethernet), capture size 96 bytes</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04: 01.092356
IP ip68-4-78-109.oc.oc.cox.net.apollo-gms >
bser2.bingotelecom.com.24646: P 1197:1249(52) ack 436 win 64499</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:03.105456
IP <a>216.209.3.235</a> > <a>f1.www.vip.sp1.yahoo.com</a>: ICMP echo
request, id 512, seq 23041, length 40</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04: 03.105939
IP bser2.bingotelecom.com.filenet-pa > ns1.yahoo.com.domain:
43789 [1au] PTR? 158.36.131.209.in-addr.arpa. (56)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:03.117544
arp who-has <a>216.209.3.235</a> tell <a>216.209.3.194</a></span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:03.158959
IP ip68-4-78-109.oc.oc.cox.net.apollo-gms >
bser2.bingotelecom.com.24646: P 3225:3277(52) ack 804 win 65535</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:03.158972
IP bser2.bingotelecom.com.24646 >
ip68-4-78-109.oc.oc.cox.net.apollo-gms : . ack 3277 win 12168</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:04.101588
IP bser2.bingotelecom.com.24646 >
ip68-4-78-109.oc.oc.cox.net.apollo-gms: . ack 3745 win 12168</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:04.542637
IP bser2.bingotelecom.com.filenet-pa > dill.arin.net.domain: 1587
[1au] PTR? 16.255.142.68.in-addr.arpa. (55)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:04.556305
IP dill.arin.net.domain > bser2.bingotelecom.com.filenet-pa:
1587- 0/5/1 (154)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:08.472526 IP <a>216.209.3.235</a> >
<a>f1.www.vip.sp1.yahoo.com</a>: ICMP echo request, id 512, seq 23297,
length 40</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04: 08.483996 arp who-has
<a>216.209.3.235</a> tell <a>216.209.3.194</a></span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:13.480338
IP <a>216.209.3.235</a> > <a>f1.www.vip.sp1.yahoo.com</a>: ICMP echo
request, id 512, seq 23553, length 40</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04: 13.492228
arp who-has <a>216.209.3.235</a> tell <a>216.209.3.194</a></span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:15.475158
IP bser2.bingotelecom.com.24646 >
ip68-4-78-109.oc.oc.cox.net.apollo-gms: . ack 7801 win 12168</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:18.488138
IP <a>216.209.3.235</a> > <a>f1.www.vip.sp1.yahoo.com</a>: ICMP echo
request, id 512, seq 23809, length 40</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">22:04:18.499693
arp who-has <a>216.209.3.235 </a>tell
<a>216.209.3.194</a></span><br><br></font></span><span><font color="#0000ff" face="Arial" size="2"><br>Is your windows firewall enabled or configured to
allow the traffic you want to allow?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Windows firewall has a pretty strict default configuration on XP
SP2 and up.<br><span style="color: rgb(0, 0, 0);">My Windows firewall is open
and I can ping that from my router. </span><br></font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Is
forwarding enabled in your kernel?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">cat
/proc/sys/net/ipv4/ip_forward</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">echo
"1" > /proc/sys/net/ipv4/ip_forward</font></span></div>
<div dir="ltr" align="left"><span></span>Yes<br><br></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Does
your internet router <a>216.209.3.193 </a>know to forward traffic for
<a>216.209.3.224/28</a> to <a>216.209.3.212</a> (ie. use .212
as gateway/route for .224/28)?<br><span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">OK, This
might be the case, cause </span></font></span><span><font color="#0000ff" face="Arial" size="2"><a style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">216.209.3.19</a><span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
3 is
managed by my internet service provider. They have given me a cable that
goes in one of my switch. My network from ISP is <a>216.209.3.192/26</a>,
which I was sub dividing to build my Linux router. </span><br style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><a>216.209.3.192/27
</a>
outside of router and <a>219.209.3.224/28</a> behind the router.
</span><br style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"></font></span><span><font color="#0000ff" face="Arial" size="2"><br><br></font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Is
your internet router's firewall configured also to allow this traffic
through it?</font></span></div>
<div dir="ltr" align="left"><span></span><font color="#0000ff" face="Arial" size="2"></font><br>Yes, I am getting traffic for my all other IPs
<br></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Do you
have any iptables mangle or nat rules, you only showed your filter
(default) table?<br><br><span style="color: rgb(0, 0, 0);">No, Mangle
and NO Nat, </span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">[root@bser2 ~]#
iptables -t mangle -L -n -v</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain PREROUTING (policy ACCEPT 1 packets, 92
bytes)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes target
prot opt in out
source
destination</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain INPUT
(policy ACCEPT 0 packets, 0 bytes) </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain FORWARD
(policy ACCEPT 0 packets, 0 bytes)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination </span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain OUTPUT
(policy ACCEPT 1 packets, 40 bytes)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain
POSTROUTING (policy ACCEPT 0 packets, 0 bytes) </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">[root@bser2 ~]# iptables -t nat -L -n
-v</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain PREROUTING (policy ACCEPT 1 packets, 510
bytes)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes target
prot opt in out
source
destination</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain
POSTROUTING (policy ACCEPT 0 packets, 0 bytes) </span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination</span><br style="color: rgb(0, 0, 0);"><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Chain OUTPUT
(policy ACCEPT 0 packets, 0 bytes)</span><br style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);"> pkts bytes
target prot opt in
out
source
destination </span><br style="color: rgb(0, 0, 0);"><br></font></span></div><br><br>
<div><span class="gmail_quote">On 10/3/07, <b class="gmail_sendername">Peter
McGill</b> <<a> petermcgill@goco.net</a> > wrote:</span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">It
doesn't look like an iptables/firewall issue, since your chains seem to
accept everything it needs to.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">However you can check your log for dropped packets to
be sure.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">grep
'kernel: IN=' /var/log/*</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">If
you see any packets in there that match packets you want to allow then
there is a misconfiguration.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">According to your ifconfig and route, you are doing
this:</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Public Internet Interface: eth0</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">IP
Address: <a>216.209.3.212</a></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Network: <a>216.209.3.192/27</a></font></span> </div>
<div dir="ltr" align="left"><span> <font color="#0000ff" face="Arial" size="2">Netmask: <a>255.255.255.224</a></font>
</span></div>
<div dir="ltr" align="left"><span> <font color="#0000ff" face="Arial" size="2">IP Address Range:
216.209.3.193-216.209.3.223</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Gateway: <a>216.209.3.193</a></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">LAN
Interface: eth1</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">IP
Address: <a>216.209.3.225</a></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Network: <a>216.209.3.224/28</a></font></span> </div><span><font size="-0">
<div dir="ltr" align="left"><span><font face="Arial"><font color="#0000ff" size="2"> Netmask:
<a>255.255.255.240</a></font></font></span></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"> IP Address Range:
216.209.3.225-216.209.239</font></div>
<div dir="ltr" align="left"></div></font></span><span><span><font color="#0000ff" face="Arial" size="2">Gateway:
<a>216.209.3.225</a></font></span></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">This
looks correct also matching your text description and your Windows
network configuration also looks correct.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Is
your windows firewall enabled or configured to allow the traffic you
want to allow?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Windows firewall has a pretty strict default configuration on XP
SP2 and up.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Is
forwarding enabled in your kernel?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">cat
/proc/sys/net/ipv4/ip_forward</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">echo
"1" > /proc/sys/net/ipv4/ip_forward</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Does
your internet router <a>216.209.3.193</a> know to forward traffic for
<a>216.209.3.224/28</a> to <a>216.209.3.212</a> (ie. use .212
as gateway/route for .224/28)?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Is
your internet router's firewall configured also to allow this traffic
through it?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Do
you have any iptables mangle or nat rules, you only showed your
filter (default) table?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div>
<div align="left"><font face="Arial" size="2">Peter McGill</font></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2">
</font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><b>From:</b> Jai Rangi
[mailto:<a>jprangi@gmail.com</a>] <br><b>Sent:</b> October 3, 2007
2:05 AM<br><b>To:</b> <a>petermcgill@goco.net</a><br><b>Cc:</b>
<a>users@openswan.org</a><br><b>Subject:</b> Re: [Openswan Users]
Firewall,Routing and Tunneling between public
networks<br></font><br></div>
<div><span>
<div></div>Hello, <br><br>I am running FC5 on my router. I have
feeling the I am missing some thing really simple btu now I am ready
to pull my hairs if I don't get the solution.... At this point
my first target to setup my Linux box as a router and my machines
behind the router with Public IP should be available to the outside
world. Below are my configuration. <br><br>[root@bser2 sysconfig]#
iptables -L -n -v<br>Chain INPUT (policy DROP 0 packets, 0
bytes)<br> pkts bytes target prot opt
in out
source
destination<br> 4 336
ACCEPT icmp --
* *
<a>0.0.0.0/0</a>
<a>0.0.0.0/0</a><br> 45 3944
ACCEPT tcp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> tcp
dpts:6000:65535<br> 0 0
ACCEPT udp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> udp dpts:2048:5799
<br> 0 0
ACCEPT udp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> udp
dpts:6000:65535<br> 0 0
ACCEPT udp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> udp
dpt:53<br> 0 0
ACCEPT udp --
* *
<a>0.0.0.0/0</a>
<a>192.168.2.0/24</a> udp
dpt:53<br> 0 0
ACCEPT tcp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> tcp
dpt:53<br> 0 0
ACCEPT tcp --
* *
<a>0.0.0.0/0</a>
<a>192.168.2.0/24</a> tcp
dpt:53<br> 0 0
ACCEPT tcp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> tcp
dpt:80<br> 0 0
ACCEPT tcp --
* *
<a>0.0.0.0/0</a>
<a>216.209.3.192/26</a> tcp
dpt:443<br> 0 0
ACCEPT all --
* *
<a>216.209.3.192/26</a>
<a>0.0.0.0/0</a><br> 0 0
ACCEPT all --
* *
<a>216.209.3.192/26</a>
<a>216.209.3.192/26</a><br>
0 0 ACCEPT all
-- *
*
<a>192.168.2.0/24</a>
<a>192.168.2.0/24</a><br> 0
0 ACCEPT all --
* *
<a>0.0.0.0/0</a>
<a>255.255.255.255 </a><br>
0 0 ACCEPT all
-- lo
*
<a>0.0.0.0/0</a>
<a>0.0.0.0/0</a><br><br>Chain FORWARD (policy DROP 0 packets, 0
bytes)<br> pkts bytes target prot opt
in out
source
destination <br> 0 0
ACCEPT all -- eth0
eth1
<a>0.0.0.0/0</a>
<a>0.0.0.0/0</a><br> 0 0
ACCEPT all -- eth1
eth0
<a>0.0.0.0/0</a>
<a>0.0.0.0/0</a><br><br>Chain OUTPUT (policy ACCEPT 50 packets, 5644
bytes)<br> pkts bytes target prot opt
in out
source
destination<br><br>Chain spoof (0 references) <br> pkts bytes
target prot opt in
out
source
destination<br> 0 0
LOG all --
* *
<a>0.0.0.0/0</a>
<a>0.0.0.0/0
</a>
limit: avg 5/min burst 5 LOG flags 0 level 4 prefix `Spoofing:
'<br> 0 0
DROP all --
* *
<a>0.0.0.0/0</a>
<a>0.0.0.0/0 </a><br>[root@bser2 sysconfig]#<br>[root@bser2
sysconfig]# ifconfig eth0<br>eth0 Link
encap:Ethernet HWaddr
00:15:C5:EB:68:D0<br>
inet addr:<a>216.209.3.212</a> Bcast:<a> 216.209.3.223</a>
Mask:<a>255.255.255.224</a><br>
inet6 addr: fe80::215:c5ff:feeb:68d0/64
Scope:Link<br>
UP BROADCAST RUNNING MULTICAST MTU:1500
Metric:1<br> RX
packets:23087 errors:0 dropped:0 overruns:0 frame:0
<br> TX
packets:21531 errors:0 dropped:0 overruns:0
carrier:0<br>
collisions:0
txqueuelen:1000<br>
RX bytes:2280064 (2.1 MiB) TX bytes:5351240 (5.1
MiB)<br>
Interrupt:16 Memory:f4000000-f4011100 <br><br>[root@bser2 sysconfig]#
ifconfig eth1<br>eth1 Link
encap:Ethernet HWaddr
00:15:C5:EB:68:CE<br>
inet addr:<a>216.209.3.225</a> Bcast:<a> 216.209.3.239
</a>
Mask:<a>255.255.255.240</a><br>
inet6 addr: fe80::215:c5ff:feeb:68ce/64
Scope:Link<br>
UP BROADCAST RUNNING MULTICAST MTU:1500
Metric:1<br> RX
packets:6479 errors:0 dropped:0 overruns:0 frame:0
<br> TX
packets:8083 errors:0 dropped:0 overruns:0
carrier:0<br>
collisions:0
txqueuelen:1000<br>
RX bytes:3309716 (3.1 MiB) TX bytes:612572 (598.2
KiB)<br>
Interrupt:16 Memory:f8000000-f8011100 <br><br>[root@bser2 sysconfig]#
route<br>Kernel IP routing
table<br>Destination
Gateway
Genmask Flags Metric
Ref Use Iface<br><a>216.209.3.224</a>
<a>216.209.3.225</a> <a>255.255.255.240</a>
UG 0
0 0
eth1<br><a>216.209.3.192</a>
*
<a>255.255.255.224</a> U
0
0 0
eth0<br><a>169.254.0.0</a>
*
<a>255.255.0.0</a> U
0
0 0
eth1<br>default
<a>216.209.3.193</a>
<a>0.0.0.0</a>
UG 0
0 0 eth0<br>[root@bser2
sysconfig]#<br><br>I think I am missing something in my routing table.
<br><br>So my network are <br><br>Internet <----------> (
<a>216.209.3.192/27</a>, GW <a>216.209.3.193</a> on Eth0 and
<a>216.209.3.225</a> on eth1) <-----------> <Network behind
the router <a>216.209.3.224/28</a> ><br><br><br>Inernet
configuration for internal machines are<br><br>C:\Documents and
Settings\Jai Rangi>ipconfig<br><br>Windows IP
Configuration<br><br><br>Ethernet adapter Local Area Connection:
<br><br> Connection-specific
DNS Suffix . :<br> IP
Address. . . . . . . . . . . . :
<a>216.209.3.235</a><br>
Subnet Mask . . . . . . . . . . . :
<a>255.255.255.240</a><br>
Default Gateway . . . . . . . . . :
<a>216.209.3.225</a><br><br>C:\Documents and Settings\Jai
Rangi><br><br>I can ping from internet to <a>216.209.3.192/27</a>
network. <br>I can not ping <a>216.209.3.225/28</a> network from
internet which is behind internet. <br>I can ping internal machine
from router. <br>I can ping router from internal machine.
<br><br><br>I will appreciate if you can please give me some hint what
I am doing wrong here. <br><br>Thank
you,<br>-Jai<br><br><br><br><br><br>
<div><span class="gmail_quote">On 10/2/07, <b class="gmail_sendername">Peter McGill
</b><<a>petermcgill@goco.net</a>> wrote:</span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">First method should work, and work easier because there is no
NAT (Network Address Translation) to worry
about.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">No reason the FORWARD rules wouldn't work on Public IPs, I
don't think they care at all what IP you give.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Make sure you don't use MASQUERADE, SNAT or DNAT
rules.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">-A adds the rules to the end of the chain, are there any
earlier rules that might block the public
traffic?</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">iptables -t filter -n -v -L</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">iptables -t nat -n -v -L</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">iptables -t mangle -n -v -L</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Will show you all your firewall rule
details.</font></span></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div>
<div align="left"><font face="Arial" size="2">Peter McGill</font></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div><font face="Arial" size="2"></font><font face="Arial" size="2"></font><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><b>From:</b>
<a>users-bounces@openswan.org</a> [mailto:<a>
users-bounces@openswan.org</a>] <b>On Behalf Of </b>Jai
Rangi<br><b>Sent:</b> October 2, 2007 2:56 AM<br><b>To:</b>
<a>users@openswan.org</a><br><b>Subject:</b> [Openswan Users]
Firewall,Routing and Tunneling between public
networks<br></font><br></div>
<div><span>
<div></div>Hello List,<br>I am trying to set up a linux server as
a router/firewall and set up a SIP tunneling between two public
networks. <br>My Diagram will be something like this<br>Internet
<-----> Linux Router <--------------> My Internal
Network with Public IPs. <br>Say My Network IPs are
<a>216.209.14.192/26</a> <br>I tried this setup.<br><br>Internet
<----> <a>216.209.14.197</a> (ExtIP <- Default Gateway
<a>216.209.14.193</a> Router -> Internal IP)
<a>216.209.14.198</a> <------> My Servers connected through
a switch with IPs 216.209.14.199-254 with Default Gateway
<a>216.209.14.198</a>. <br>This set up did not work. <br><br>If I
do this<br>Internet <----> <a>216.209.14.197</a> (ExtIP
<- Default Gateway <a>216.209.14.193</a> Router -> Internal
IP) <a>192.168.1.1</a> <------> My Servers connected through
a switch with IPs 192.168.1.199-254 with Default Gateway
<a>192.168.1.1</a>.<br><br>I can go out through ip forwarding like
this... <br>iptables -P FORWARD DROP<br>iptables -A FORWARD -s
${HUB_LAN} -j ACCEPT<br>iptables -A FORWARD -d ${HUB_LAN} -j
ACCEPT <br><br>These rules does not work with public IPs.
<br><br>My Other Questions are<br>1. Can I use racoon for SIP
tunneling, is there any limit on number of sessions. Bought a
juniper router and found out that the router supports on 16
channels. I need to support at least 400 SIP channels. <br>2. I
have seen a lot of documentation of setting up Masquarding and IP
Forwarding. I made it work but that does not solve my purpose. I
need to assign Public IP to the my machines behind the router so
that outside world can access those machines through router
directly. <br>3. I need to have tunneling with one service
provider for network <a>56.211.34.23/27</a>. For rest of the world
I want the traffic to go through the router without any
modification. I might want to add some firewall rules later for
some specific port. <br><br>I will appreciate if some one can give
me some lead on how can I achieve this. <br><br>Thank
you,<br>JP<br></span></div></blockquote></div></blockquote></div><br></span></div></blockquote></blockquote></div><br></span></div></blockquote></div></blockquote></div><br></span></div></blockquote>
</blockquote></div><br>