2

I am not sure what's going on, but I have setup a gateway debian box with iptables and dhcpd server. The server is handing out the ip addresses to the clients just fine, gateway being set to the debian box and dns set to the ISP dns. Now I can't figure out why the net isn't working on the clients computers. The box is configured as eth0 (192.168.0.1) being the internal LAN and eth1 being the external to the internet. I have ip_forwarding set to 1, on as well. Here is my output from the iptables-save command. If anyone can help, please let me know!

UPDATE 1: I redid the rules to very very basic and it still is happening... tracert times out on the client and can't ping google on the client but can ping the gateway and other clients...and NET works fine on router box

UPDATE 2: As per Patricks suggestion, set forward to accept and still having same issues.

# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*mangle
:PREROUTING ACCEPT [8:608]
:INPUT ACCEPT [8:608]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:528]
:POSTROUTING ACCEPT [4:528]
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE 
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar  5 20:46:23 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:628]
-A INPUT -i lo -j ACCEPT 
-A INPUT -i eth0 -j ACCEPT 
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT 
-A FORWARD -s 192.168.0.0/24 -i eth0 -j ACCEPT 
-A FORWARD -d 192.168.0.0/24 -i eth1 -j ACCEPT 
COMMIT
# Completed on Mon Mar  5 20:46:23 2012
Improve this question
12
  • Can you ping the gateway. What results do you get from a tracerote? Can the gateway get out?
    – Zoredache
    Mar 7, 2012 at 16:14
  • Yes I can ping the gateway from he clients. The gateway can get out to the internet fine. Results from tracert on the client isn't good... request times out on the first hop and all other hops.
    – John
    Mar 7, 2012 at 16:18
  • Your firewall is pretty involved. Have you tried replacing it with the bare-minimum rule-set? Perhaps just a MASQ statement, and setting all the policies to ACCEPT?
    – Zoredache
    Mar 7, 2012 at 17:16
  • Even after the edit you just did, you still have forward set to drop.
    – phemmer
    Mar 7, 2012 at 18:35
  • Youre sure /proc/sys/net/ipv4/ip_forward is enabled? (you did say ip_forwarding not ip_forward so I'm just making sure)
    – phemmer
    Mar 7, 2012 at 18:58

1 Answer 1

Reset to default
5

You have the FORWARD filter set to DROP. So iptables is dropping all forwarding. If you want to keep it set to DROP, you need to add the following rule

iptables -I FORWARD -i eth0 -s 192.168.0.0/24 -j ACCEPT
iptables -I FORWARD -i eth1 -d 192.168.0.0/24 -j ACCEPT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .