Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am not sure what's going on, but I have setup a gateway debian box with iptables and dhcpd server. The server is handing out the ip addresses to the clients just fine, gateway being set to the debian box and dns set to the ISP dns. Now I can't figure out why the net isn't working on the clients computers. The box is configured as eth0 (192.168.0.1) being the internal LAN and eth1 being the external to the internet. I have ip_forwarding set to 1, on as well. Here is my output from the iptables-save command. If anyone can help, please let me know!

UPDATE 1: I redid the rules to very very basic and it still is happening... tracert times out on the client and can't ping google on the client but can ping the gateway and other clients...and NET works fine on router box

UPDATE 2: As per Patricks suggestion, set forward to accept and still having same issues.

# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*mangle
:PREROUTING ACCEPT [8:608]
:INPUT ACCEPT [8:608]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:528]
:POSTROUTING ACCEPT [4:528]
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE 
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:628]
-A INPUT -i lo -j ACCEPT 
-A INPUT -i eth0 -j ACCEPT 
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT 
-A FORWARD -s 192.168.0.0/24 -i eth0 -j ACCEPT 
-A FORWARD -d 192.168.0.0/24 -i eth1 -j ACCEPT 
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
share|improve this question
    
Can you ping the gateway. What results do you get from a tracerote? Can the gateway get out? –  Zoredache Mar 7 '12 at 16:14
    
Yes I can ping the gateway from he clients. The gateway can get out to the internet fine. Results from tracert on the client isn't good... request times out on the first hop and all other hops. –  John Mar 7 '12 at 16:18
    
Your firewall is pretty involved. Have you tried replacing it with the bare-minimum rule-set? Perhaps just a MASQ statement, and setting all the policies to ACCEPT? –  Zoredache Mar 7 '12 at 17:16
    
Even after the edit you just did, you still have forward set to drop. –  Patrick Mar 7 '12 at 18:35
    
Youre sure /proc/sys/net/ipv4/ip_forward is enabled? (you did say ip_forwarding not ip_forward so I'm just making sure) –  Patrick Mar 7 '12 at 18:58
show 7 more comments

1 Answer

up vote 5 down vote accepted

You have the FORWARD filter set to DROP. So iptables is dropping all forwarding. If you want to keep it set to DROP, you need to add the following rule

iptables -I FORWARD -i eth0 -s 192.168.0.0/24 -j ACCEPT
iptables -I FORWARD -i eth1 -d 192.168.0.0/24 -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.