[SOLVED]Shorewall Problem?

[gailkoontz]

I just installed Mageia 3 on a new computer. My last Linux install was Mandriva 2009 Spring on another computer. (What can I say? Linux was so stable that I didn't have any reason to change it.) Internet access and networking worked perfectly on the old computer.

On the new one I have Internet access. The network is connected, because I can ping back and forth with no problem, but the Windows computer and the Tivo can't reach the Internet. I installed the network manually. I can't use the control center configuration because every time I try it messes up the hosts file by setting my computer's address to the same as loopback, no matter what I entered, instead of (ex) gail.homenet.net. (I had the same problem with Mandriva.) I don't think this is a Windows problem, since the Tivo has no access either, and it runs Linux.

I set up Shorewall the same way I did for the old computer, and it loads with no errors (I can supply the log entries, but there are a lot of them), but I suspect my problem may lie there because of changes in the last few years. Here are the only files I modify:

Interfaces

net eth0
loc eth1

Masq

eth0 192.168.1.0/25

Policy

loc net ACCEPT
loc loc ACCEPT
loc fw ACCEPT
fw loc ACCEPT
fw net ACCEPT
net all DROP info
all all REJECT info

Rules

ACCEPT net fw tcp 6881:6889 [left over from a time when I was using bittorrent]
[I commented out the rule about using rules.drakx, since there is nothing in the file anyway.]

Zones

net ipv4
loc ipv4
fw firewall

And in etc.

hosts.deny

ALL:ALL

hosts.allow

ALL: 192.168.1
ALL: 127.0.0.1

Can anyone see a problem here or suggest where else I might look? I really don't want to switch back to the old computer, butTivo will soon starve for programming input, and my phone line keeps cutting it off before it can finish

May thanks for any suggestions. I'm afraid I've become a bit stupid about network setup.

Gail

[doktor5000]

I can't use the control center configuration because every time I try it messes up the hosts file by setting my computer's address to the same as loopback, no matter what I entered, instead of (ex) gail.homenet.net. (I had the same problem with Mandriva.) I don't think this is a Windows problem, since the Tivo has no access either, and it runs Linux.

Yes you can use it. It will only add the hostname you want to your local machine/loopback interface.

Code: Select all

[doktor5000@Mageia3 ~]$ cat /etc/hosts
# generated by drakconnect
127.0.0.1 Mageia3
127.0.0.1 localhost

That is totally normal and not broken.

[gailkoontz]

Thanks, it's nice to know that, and I may make use of it in the future, but it doesn't solve my current problem unless something has changed that makes this arrangement mandatory. As far as I know my manual setup is the same as I've always had it, but it isn't working, and I really need to get Internet access for the other computer and the Tivo.

Gail

[jiml8]

From the command line, as root, enter the following commands and paste the results into a message here:

ifconfig

route

[isadora]

Code: Select all

eth0      Link encap:Ethernet  HWaddr D4:3D:7E:9E:95:8A 
          inet addr:68.204.76.76  Bcast:255.255.255.255  Mask:255.255.240.0
          inet6 addr: fe80::d63d:7eff:fe9e:958a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:211628 errors:0 dropped:0 overruns:0 frame:0
          TX packets:122966 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:283953875 (270.7 MiB)  TX bytes:11515678 (10.9 MiB)

eth1      Link encap:Ethernet  HWaddr 68:05:CA:12:09:68 
          inet addr:192.168.1.5  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::6a05:caff:fe12:968/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7180 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1208 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1057071 (1.0 MiB)  TX bytes:343830 (335.7 KiB)
          Interrupt:16 Memory:feae0000-feb00000

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:63 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5482 (5.3 KiB)  TX bytes:5482 (5.3 KiB)

That's it - Gail

[gailkoontz]

Oops - forgot the route!

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 68-204-64-1.res 0.0.0.0 UG 10 0 0 eth0
default 192.168.1.1 0.0.0.0 UG 10 0 0 eth1
68.204.64.0 * 255.255.240.0 U 10 0 0 eth0
link-local * 255.255.0.0 U 10 0 0 eth0
link-local * 255.255.0.0 U 10 0 0 eth1
192.168.1.0 * 255.255.255.0 U 10 0 0 eth1

Gail

[jiml8]

OK. Your ifconfig and route looks OK, but I see upon review that you are having problems with Windows computers. I presume these computers are connected to your LAN on eth1?

This could be a shorewall problem, and shorewall sends me up the wall periodically; it is very complicated. It is documented, but there is a LOT of documentation to wade through.

Do you have internet connection sharing set up in Drakconf? There is a warning in drakconf specifically to disable shorewall on the ethernet adapter that services your LAN. I suggest you do that.

If you still do not have internet access for the LAN devices, you can set it manually with the following iptables rule, enabling NAT for your LAN to the internet:

Code: Select all

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 68.204.76.76


Failing that, you can bridge directly from eth1 to eth0 but I don't recommend it for a Windows machine particularly.

[gailkoontz]

I had already decided the problem couldn't be with Windows, since the Tivo had the same problem, and it runs Linux. I also eventually decided Shorewall wasn't the cluprit, since the network still had no Internet access even if I turned it off.

I did finally get everything to work, and I only with I knew how. I hadn't been able to set up the network using the Control Center, because it never liked how I filled in the blanks, and I couldn't set up sharing without a network setup it liked. Somehow I eventually managed to get enought right manually to where the Control Center sharing accepted my network setup and completed the process. I don't know what file got changed for the better. All the ones I knew about look the same, and the Shorewall files are essentially the same also. So my problem is fixed, but I'm still ignorant.

Anyway, thanks to everyone who tried to help!

Gail

[doktor5000]

Please mark the thread accordingly by editing the topic of the first post and prefix it by [SOLVED], thanks