ProlIant 850R as Linux Router

[Sven Geschke]

Hi

Basically I try to create a dmz, so here's the setup:

DSL-Modem
|
|
outgate.xx.xxxx.com /*RH9 w/ iptables and NAT*/
eth1:192.168.49.1/24 /*AFAIK unimportant for pppoe*/
eth0:10.49.0.1/24
|
|
Ethernet-Switch /*some more machines are connected to this,*/
| /*all of them in the 10.49.0.0/24 subnet*/
|
ingate.xx.xxxx.com /*RH9, running dhcpd and named for*/
eth0:10.49.0.3/24 /*subnet 10.49.1.0/24 over eth1*/
eth1:10.49.1.1/24 /dhcpd and named working fine*/
|
|
Ethernet-Switch
|
|
wks-xx.xx.xxxx.com /*Several machines running WinXP Pro*/
eth0:10.49.0.5 /*(for an example)*/


As already mentioned, the Problem is routing on "ingate".
The kernelversion is 2.4.20-8 SMP (dual cpu-box)
This is the configuration data of the interfaces:

eth0 Link encap:Ethernet HWaddr 00:80:5F:EF:98:61
inet addr:10.49.0.3 Bcast:10.49.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1494 errors:0 dropped:0 overruns:0 frame:0
TX packets:1876 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:157273 (153.5 Kb) TX bytes:148254 (144.7 Kb)
Interrupt:9 Base address:0x6400

eth1 Link encap:Ethernet HWaddr 00:50:FC:60:D3:D2
inet addr:10.49.1.1 Bcast:10.49.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:677 errors:0 dropped:0 overruns:0 frame:0
TX packets:373 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:55804 (54.4 Kb) TX bytes:35440 (34.6 Kb)
Interrupt:9 Base address:0xd000

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt
Iface
255.255.255.255 0.0.0.0 255.255.255.255 UH 0 0 0 eth1
10.49.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.49.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 10.49.0.1 0.0.0.0 UG 0 0 0 eth0

I do know that the 255.255.255.255 (host-) route is for dhcp,
but I can't imagine what that route to 169.254.0.0 should mean.

The value of "/proc/sys/net/ipv4/ip-forward" is "1".

Pinging from 10.49.0.5 (WinXP Workstation) I get the following results:

/*for eth1 of the router (ingate)*/
Pinging 10.49.1.1 with 32 bytes of data:
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Ping statistics for 10.49.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

/*for eth0 of the router (ingate)*/
Pinging 10.49.0.3 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.49.0.3:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

/*for eth0 of the internet-gateway (outgate)*/
Pinging 10.49.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.49.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

/*Pinging from the router (ingate) looks like this:*/

PING 10.49.0.1 (10.49.0.1) 56(84) bytes of data.
64 bytes from 10.49.0.1: icmp_seq=1 ttl=64 time=0.916 ms
64 bytes from 10.49.0.1: icmp_seq=2 ttl=64 time=0.936 ms
64 bytes from 10.49.0.1: icmp_seq=3 ttl=64 time=0.968 ms
64 bytes from 10.49.0.1: icmp_seq=4 ttl=64 time=0.769 ms
64 bytes from 10.49.0.1: icmp_seq=5 ttl=64 time=0.733 ms
64 bytes from 10.49.0.1: icmp_seq=6 ttl=64 time=1.03 ms
64 bytes from 10.49.0.1: icmp_seq=7 ttl=64 time=0.747 ms
64 bytes from 10.49.0.1: icmp_seq=8 ttl=64 time=0.804 ms
64 bytes from 10.49.0.1: icmp_seq=9 ttl=64 time=0.727 ms

--- 10.49.0.1 ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 8048ms
rtt min/avg/max/mdev = 0.727/0.848/1.036/0.113 ms

PING 10.49.0.3 (10.49.0.3) 56(84) bytes of data.
64 bytes from 10.49.0.3: icmp_seq=1 ttl=64 time=0.219 ms
64 bytes from 10.49.0.3: icmp_seq=2 ttl=64 time=0.070 ms
64 bytes from 10.49.0.3: icmp_seq=3 ttl=64 time=0.065 ms
64 bytes from 10.49.0.3: icmp_seq=4 ttl=64 time=0.068 ms
64 bytes from 10.49.0.3: icmp_seq=5 ttl=64 time=0.066 ms
64 bytes from 10.49.0.3: icmp_seq=6 ttl=64 time=0.071 ms
64 bytes from 10.49.0.3: icmp_seq=7 ttl=64 time=0.065 ms
64 bytes from 10.49.0.3: icmp_seq=8 ttl=64 time=0.067 ms

--- 10.49.0.3 ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7033ms
rtt min/avg/max/mdev = 0.065/0.086/0.219/0.050 ms

PING 10.49.1.1 (10.49.1.1) 56(84) bytes of data.
64 bytes from 10.49.1.1: icmp_seq=1 ttl=64 time=0.199 ms
64 bytes from 10.49.1.1: icmp_seq=2 ttl=64 time=0.260 ms
64 bytes from 10.49.1.1: icmp_seq=3 ttl=64 time=0.068 ms
64 bytes from 10.49.1.1: icmp_seq=4 ttl=64 time=0.072 ms
64 bytes from 10.49.1.1: icmp_seq=5 ttl=64 time=0.065 ms
64 bytes from 10.49.1.1: icmp_seq=6 ttl=64 time=0.066 ms

--- 10.49.1.1 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5023ms
rtt min/avg/max/mdev = 0.065/0.121/0.260/0.079 ms

PING 10.49.1.2 (10.49.1.2) 56(84) bytes of data.
64 bytes from 10.49.1.2: icmp_seq=1 ttl=128 time=0.302 ms
64 bytes from 10.49.1.2: icmp_seq=2 ttl=128 time=0.207 ms
64 bytes from 10.49.1.2: icmp_seq=3 ttl=128 time=0.188 ms
64 bytes from 10.49.1.2: icmp_seq=4 ttl=128 time=0.189 ms
64 bytes from 10.49.1.2: icmp_seq=5 ttl=128 time=0.188 ms
64 bytes from 10.49.1.2: icmp_seq=6 ttl=128 time=0.192 ms
64 bytes from 10.49.1.2: icmp_seq=7 ttl=128 time=0.186 ms

--- 10.49.1.2 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6026ms
rtt min/avg/max/mdev = 0.186/0.207/0.302/0.041 ms


Are there any known hardware issues (ie incompatibilities etc.)?

Rgds
Sven

[Alexander Chuzhoy]

169.254.0.0 is route for APIPA -Automatic Private IP addresssing.Windows 98/2000/XP
use the same mechanism .It's for the home users who don't want to/don't know how to assign IP addresses for their network cards and still want to be able sharing files among multiple computers.All their computers will have IP from 169.254.0.0 subnet with mask 255.255.0.0.
I don't know about any hardware issues -can't help you.
Can you give ass the route tables of two machines that can't connect with each other?
Best regards

[Sven Geschke]

> 169.254.0.0 is route for APIPA -Automatic
> Private IP addresssing.Windows 98/2000/XP
> use the same mechanism .It's for the home
> users who don't want to/don't know how to
> assign IP addresses for their network
> cards and still want to be able sharing
> files among multiple computers.
> All their computers will have IP from
> 169.254.0.0 subnet with mask 255.255.0.0.

Didn't know that, thanks :-)

> I don't know about any hardware issues -
> can't help you.

That's okay, at least I'm one step further with the unknown route...

> Can you give ass the route tables of two
> machines that can't connect with each
> other?

Sure, if you don't mind it's partly in german...
This one is from one of the workstations:

Aktive Routen:
Netzwerkziel Netzwerkmaske Gateway Schnittstelle Anzahl
0.0.0.0 0.0.0.0 10.49.1.1 10.49.1.4 20
10.49.1.0 255.255.255.0 10.49.1.4 10.49.1.4 20
10.49.1.4 255.255.255.255 127.0.0.1 127.0.0.1 20
10.255.255.255 255.255.255.255 10.49.1.4 10.49.1.4 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
224.0.0.0 240.0.0.0 10.49.1.4 10.49.1.4 20
255.255.255.255 255.255.255.255 10.49.1.4 10.49.1.4 1
Standardgateway: 10.49.1.1

This one is from the internet gateway:

Kernel IP Routentabelle
Destination Router Genmask Flags MSS Window irtt Iface
217.5.98.40 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
10.49.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.49.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 217.5.98.40 0.0.0.0 UG 0 0 0 ppp0

This one is from the router between them:

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt
Iface
255.255.255.255 0.0.0.0 255.255.255.255 UH 0 0 0 eth1
10.49.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.49.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 10.49.0.1 0.0.0.0 UG 0 0 0 eth0

Thanks for your help

Rgds
Sven

[Alexander Chuzhoy]

you wrote:
Pinging from 10.49.0.5 (WinXP Workstation) I get the following results:
/*for eth1 of the router (ingate)*/
Pinging 10.49.1.1 with 32 bytes of data:
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Reply from 10.49.1.1: bytes=32 time<1ms TTL=64
Ping statistics for 10.49.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
/*for eth0 of the router (ingate)*/
Pinging 10.49.0.3 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.49.0.3:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
/*for eth0 of the internet-gateway (outgate)*/
Pinging 10.49.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

So I guess you want to find out why there are no pings between 10.49.0.5 to 10.49.0.1 while there are still ping from the router and 10.49.0.1
If it's so then please let us see the route table of 10.49.0.1 and the route table of 10.49.0.5
regards.

[Sven Geschke]

Severe typo, my fault!!!

I ping from 10.49.1.5, not from 10.49.0.5

Sorry

smg

[Alexander Chuzhoy · Accepted solution]

add a route to the XP station taht you ping from:
route add 10.49.0.0 mask 255.255.255.0 10.49.1.1

one command and not line wrapped.
I wrote 10.49.1.1 -I guess that it's the default gateway of XP.
If the gateway has another IP then you must use it instead of 10.49.1.1
Best regards.
"Work for points"

[Sven Geschke]

Good hint...
the trick is to do that on the outbound router (10.49.0.1) who was the problem all the way, because it simply had no route back to the 10.49.1.0/24 subnet! :-)
I found that one out 25 seconds before i read your last reply, but anyway... 10 points for you! ;-)