From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Mon, 31 Mar 2003 20:15:54 +0300 From: Michael Shigorin To: community-en@altlinux.org Cc: community@altlinux.ru Subject: Re: [Comm-en] sharing Internet access Message-ID: <20030331171554.GK3889@osdn.org.ua> Mail-Followup-To: community-en@altlinux.org, community@altlinux.ru References: <200303311029.03630.djbouley@shaw.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200303311029.03630.djbouley@shaw.ca> User-Agent: Mutt/1.4.1i Sender: community-en-admin@altlinux.org Errors-To: community-en-admin@altlinux.org X-BeenThere: community-en@altlinux.org X-Mailman-Version: 2.0.9 Precedence: bulk Reply-To: community-en@altlinux.org List-Unsubscribe: , List-Id: List-Post: List-Help: List-Subscribe: , List-Archive: Archived-At: List-Archive: List-Post: On Mon, Mar 31, 2003 at 10:29:03AM -0600, D&J Bouley wrote: > I named our local network "VirtualSkyNet" and my gateway > address to 192.168.0.1 during the set-up. Good. :) > Do I replace the $LOCALNET=192.168.9.0/24 variable with > $VirtualSkyNet=192.168.0.1/24 in the script below? No, it's just the _variable_ name. > I assume I only have to run this script once to get Internet > sharing functional. Well this could be simpler: --- /etc/sysconfig/iptables --- *filter -A INPUT -j tcprules -A FORWARD -j tcprules -A tcprules -i ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A tcprules -i ! ppp0 -m state --state NEW -j ACCEPT -A tcprules -i ppp0 -m state --state INVALID,NEW -j DROP -A tcprules -i ppp0 -j REJECT --reject-with icmp-host-unreachable COMMIT *nat -A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE COMMIT --- end of /etc/sysconfig/iptables --- (btw, 192.168.0.0/24 and 192.168.0.1/24 are just the same as the last byte would be outside the _network_ address being the _host_ part) Then make sure /etc/sysctl.conf has the line as here: --- net.ipv4.ip_forward = 1 --- (my favorite oops-forgot-it is not to enable forwarding %) To enable it all now, do rmmod ipchains echo "1" > /proc/sys/net/ipv4/ip_forward service iptables restart which will result in stateful firewall with NAT up and running. Well, hopefully -- I didn't actually test this :-) PS: if the internet interface is not ppp0 and say eth1 -- make appropriate changes. PPS: 2ALT: hey if we've broken drakgw we'd really better introduce something yet better ;-) -- ---- WBR, Michael Shigorin ------ Linux.Kiev http://www.linux.kiev.ua/