[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: simple firewall for masquerade



Joakim Roubert wrote:

On Tue, 25 Feb 2003, Adam C Powell IV wrote:
That is, does it not auto-detect the EXTERNAL and INTERNAL interfaces
correctly?
It seems that it gets eth0 (my external) as EXTERNAL and then eth1 (my
internal) as INTERNAL, but I'm not sure. How can I confirm this?

I don't know, maybe sticking some echo statements into the script...

Which version of ipmasq are you using?  Woody has 3.5.10, can't help you
with anything higher.  (And I don't really know much about the version
in woody -- except that it works for me.)
Now I use ipmasq 3.5.11. It seems to start up properly and so on, and the
computer attached has the same settings as when I hade my firewall running
under RedHat (so I reckon that config is alright). Then I started checking
once more if there really wasn't something I had forgotten to put into the
kernel. The documentation says:

       * `CONFIG_NETFILTER'
       * `CONFIG_IP_NF_TABLES'
       * `CONFIG_IP_NF_CONNTRACK'
       * `CONFIG_IP_NF_NAT'
       * `CONFIG_IP_NF_TARGET_MASQUERADE'

And here I find a strange thing; I don't have the option
CONFIG_IP_NF_TABLES in my 2.4.20 config file. Instead, there is a
CONFIG_IP_NF_IPTABLES (could that be the same?), which I have compiled in
the kernel. Thus, I have the following in the current kernel:

CONFIG_IP_NF_IPTABLES=y
CONFIG_NETFILTER=y
CONFIG_IP_NF_CONNTRACK=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_TARGET_MASQUERADE=y

It still doesn't work, though... :(

You also need ipchains (or rather, the ipchains-compatible front-end to netfilter), as that's what ipmasq uses -- at least, that's what 3.5.10 uses. All of the stock Debian kernels seem to have everything needed...

Again, that's all I know -- you might consider emailing the author.

Zeen,
--

-Adam P.

GPG fingerprint: D54D 1AEE B11C CE9B A02B  C5DD 526F 01E8 564E E4B6

Welcome to the best software in the world today cafe! <http://lyre.mit.edu/%7Epowell/The_Best_Stuff_In_The_World_Today_Cafe.ogg>





Reply to: