I've just setup a new CentOS 6.4 machine to act as a default gateway for the LAN at head office. It's primary task is simply to route traffic to the appropriate place, ie VPN servers or the firewall server. This is working.
However we want to monitor the traffic going through this machine. So I've installed
- ntopng and that only sees a few MB instead of GB of the traffic, so I've removed that
- and put the older ntop on, and that's doing the same
- tried iptraf and I think that's not seeing the traffic either
- tried creating some iptables accept rules and the command: iptables --list -v -n --line-numbers and that still does not see much of the traffic traversing through the gateway machine.
Notes on the network setup
- Modem has
- IP 192.168.2.3/24
- NAT Enabled
- DMZ pointing to 192.168.2.252
- Firewall has
- eth1 IP 192.168.2.252/24
- eth0 IP 192.168.0.254/24
- CentOS gatway machine has
- eth0 IP 192.168.0.241/24
- eth0:1 (same nic) IP 192.168.1.241/24
- default gateway of 192.168.0.254
- /etc/sysconfig/network has the line FORWARD_IPV4=true
- /etc/sysconfig/network-scripts/route-eth0 has a bunch of lines like 192.168.5.0/24 via 192.168.1.2
- VPN Servers
- IP Addresses in the 192.168.1.0/24 range such as 192.168.1.2
- client machines have
- IP addresses in the range 192.168.0.50 - 192.168.0.150
- default gateway of 192.168.0.241
How can the gateway machine not see the traffic going through it from the client machines when they are browsing the web? and what do you suggest I do to fix the traffic monitoring capabilities of this machine?
My guess is the OS is configured incorrectly for this to work. However I don't see how. Apart from having a 2nd IP address it is configured very similarly to how we have another branch setup, and that one is working.