[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Help with IP forwarding [more info]

This is a repost. I left out some important information.

The question is how or if it is possible to set up a firewall when the
local lan side is not a different network but just one or more hosts on
the same subnet as the firewall and the firewall's gateway?

The Win95 box below has it's gateway as (the Linux box) with a
netmask of The linux box has it's gateway as

Here is the repost:

I have a cable modem connection that is just being converted to a
"business-class" connection, which means I get 5 statics IP addresses
and my packets destined to the office are routed directly.

I can't get IP forwarding to forward anything.

The setup is simple: (I've disguising actual IP's in this message as
just "1.1.1.n"):

cableModem  <--->  LinuxBox  <--->  Win95Box
                  .244 .245         .246

The Linux box has two ethernet cards.

I can ping Win95 from Linux, ping and telnet from Win95 to Linux, but
Win95 can't reach beyond Linux to the internet, and from outside the
cable modem I can't see past Linux to the Win95. IE, it's as if IP
forwarding isn't forwarding.

eth0 is the cable modem side:

#  configure the IP address, netmask and broadcast address.
sudo /sbin/ifconfig eth0 netmask broadcast
# add a network route to point to it:
sudo /sbin/route add -net device eth0
# Add a default route.                             
sudo /sbin/route add default gw

eth1 is the Win95 lan side:
sudo /sbin/ifconfig eth1 netmask broadcast
sudo arp -s 00:10:4B:1E:A4:1B pub
sudo arp -a
sudo /sbin/route add -host device eth1
sudo /sbin/route add -host device eth1

Note that my local lan isn't a subnet, just one host (Win95) with houst
routes defined for the ethernet card ( and Win95 (

tcpdump on eth1 while Win95 is trying to ping the cable gateway just
shows the following, with no activity on the other side (eth0):

11:01:24.296343 arp who-has tell
11:01:25.796343 arp who-has tell
11:01:26.816343 arp who-has tell

I tried to turn on logging with this command:
/sbin/ipfwadm -A both -W eth1 -i -o

and /var/adm/kern.log shows this:

May  2 11:02:07 timshel kernel: IP acct in eth1 UDP L=70 S=0x00 I=16137 F=0x0000 T=32 
May  2 11:02:07 timshel kernel: IP acct in eth1 UDP L=70 S=0x00 I=16137 F=0x0000 T=32

Any ideas what I'm missing?


To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: