Cannot connect to the Internet

S

SteveB

I'm a newbie and need some assistance with getting my home network to connect to the internet. My configuration looks likes this:

Code: 
Internet --> FIOS modem --> FreeBSD server --> switch -- linux PC
             192.168.1.1    fxp0 (DHCP)          |        IP: 10.0.0.4
                            dc0 (10.0.0.2)       |        Gateway 10.0.0.2
                                                 |        DNS 192.168.1.1
                                                 |
                                              Windows XP PC
                                              IP 10.0.0.3
                                              Gateway 10.0.0.2
                                              DNS 192.168.1.1

I can ping from the Windows PC to any address on my net except 192.1.1. The same with the linux PC, any address except 192..168.1.1. Neither can reach the internet. The FreeBSD server can ping any address on the network and can reach anything on the internet. My two PCs can telnet and FTP to the FreeBSD server. The windows PC can access the Samba service on the server.
What am I missing that I cannot reach the internet with the two PCs? I have attached my rc.conf, the results of nnetstat -rn and the results of ifconfig.
Any help would be greatly appreciated!
 
Sorry, I didn't post my config files...

/etc/rc.conf

Code: 
# -- sysinstall generated deltas -- # Sun Feb 14 02:17:25 2010
# Created: Sun Feb 14 02:17:25 2010
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
hald_enable="YES"
dbus_enable="YES"
inetd_enable="YES"
ftpd_enable="YES"
gateway_enable="YES"
ipfilter="YES"
ipfilter_rules="/etc/ipf.rules"
ipnat_enable="YES"
ipnat_rules="/etc/ipnat.rules"
ipmon_enable="YES"
ipmon_flags="Ds"
named_enable="YES"
hostname="thx1138.home.net"
ifconfig_dc0="inet 10.0.0.2 netmask 255.255.255.0"
ifconfig_fxp0="DHCP"
moused_enable="YES"
nfs_server_enable="YES"
rpcbind_enable="YES"
winbindd_enable="YES"
samba_enable="YES"
saver="fire"

Results of netstat -rn


Code: 
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            	192.168.1.1       UGS         0      542   fxp0
10.0.0.0/24        link#1             	U              2    1107    dc0
10.0.0.2           	link#1             	UHS          0        6    lo0
127.0.0.1          link#6             	UH            0      105    lo0
192.168.1.0/24  	link#4             	U              0      478   fxp0
192.168.1.4      	link#4             	UHS         0        13    lo0

Internet6:
Destination                    Gateway                  Flags      Netif Expire
::1                               	::1                           UH          lo0
fe80::%lo0/64                link#6                       U           lo0
fe80::1%lo0                   link#6                       UHS      lo0
ff01:6::/32                      fe80::1%lo0              U           lo0
ff02::%lo0/32                  fe80::1%lo0              U           lo0

Results of ifconfig

Code: 
dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 00:50:bf:a7:9b:a2
        inet 10.0.0.2 netmask 0xffffff00 broadcast 10.0.0.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
fwe0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:0c:f1:86:da:c5
        ch 1 dma -1
fwip0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        lladdr 0.c.f1.0.0.86.da.c5.a.2.ff.fe.0.0.0.0
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=2009<RXCSUM,VLAN_MTU,WOL_MAGIC>
        ether 00:0c:f1:86:da:c5
        inet 192.168.1.4 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
 
My apologies for the messed up diagram above and for not putting the config code in quotes like I'm suppose to, please bear with me as I learn. I'll do this correctly next time.

Since the diagram of my network didn't work out, let me describe my home net; Internet to FIOS modem which is serving DHCP from 192.168.1.1 to my FreeBSD server on NIC fxp0 which is set to DHCP. The NIC facing my LAN is dc0 and it's IP is 10.0.0.2. From there to a 4-port switch which has a linux PC (NIC 10.0.0.4 gateway 10.0.0.2 DNS 192.168.1.1) and a Windows XP PC (IP 10.0.0.3 gateway 10.0.0.2 DNS 192.168.1.1). The resolv.conf on the FreeBSD server looks like this;

Code: 
search home
nameserver 192.168.1.1
[steve@thx1138 /etc]$

Best regards.
 
Thanks jailed, but that did not work. Nothing has changed except that there is now this additional entry when I run ifconfig

Code: 
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 0e:e8:4b:0d:29:67
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: dc0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 1 priority 128 path cost 200000

I was thinking that this was, perhaps, a routing issue that I'm not seeing. Does anyone else have any suggestions?

Regards
 
What about a gateway

if the FBSD server has two interfaces has it been set up as a gateway to route between them? I have a somewhat similar setup and the server (actually a firewall), does not use dhcp. It has an IP addy for each interface and routes between them; which it would need to do with or without firewall rulesets to obey. maybe something like this (fake addys):
HTML: 
net --> router 10.0.0.1 --> server 10.0.0.2                box1 192.168.1.2
                            server 192.168.1.1 --> switch /
                                                          \ box2 192.168.1.3

The server has to route between the two interfaces. Dump the dhcp bit. And good luck.

sa
 
Here are the two files request;

/etc/ipf.rules:

Code: 
# 

pass out quick on dc0 all
pass in quick on dc0 all

pass in quick on lo0 all
pass out quick on lo0 all

pass out quick on fxp0 proto tcp from any to 192.168.1.1 port = 53 flags S keep state
pass out quick on fxp0 proto udp from any to 192.168.1.1 port = 53 keep state

pass out quick on fxp0 proto udp from any to 192,168.1.1 port = 67 keep state

pass out quick on fxp0 proto tcp from any to any port = 80 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 443 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 110 flags S keep state
pass out quick on fxp0 proto tcp from any to any port = 25 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 37 flags S keep state

#pass out quick on dc0 proto tcp from any to any port = 119 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 21 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 22 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 23 flags S keep state

pass out quick on fxp0 proto tcp from any to any port = 5999 flags S keep state

pass out quick on fxp0 proto icmp from any to any icmp-type 8 keep state

pass out quick on fxp0 proto tcp from any to any port = 43 flags S keep state


block out log first quick on dc0 all



# Block all inbound traffic from non-routable or reserved address spaces
block in quick on fxp0 from 192.168.0.0/16 to any    #RFC 1918 private IP
block in quick on fxp0 from 172.16.0.0/12 to any     #RFC 1918 private IP
block in quick on fxp0 from 10.0.0.0/8 to any        #RFC 1918 private IP
block in quick on fxp0 from 127.0.0.0/8 to any       #loopback
block in quick on fxp0 from 0.0.0.0/8 to any         #loopback
block in quick on fxp0 from 169.254.0.0/16 to any    #DHCP auto-config
block in quick on fxp0 from 192.0.2.0/24 to any      #reserved for docs
block in quick on fxp0 from 204.152.64.0/23 to any   #Sun cluster interconnect
block in quick on fxp0 from 224.0.0.0/3 to any       #Class D & E multicast

##### Block a bunch of different nasty things. ############

block in quick on fxp0 all with frags

block in quick on fxp0 proto tcp all with short

block in quick on fxp0 all with opt lsrr
block in quick on fxp0 all with opt ssrr

block in log first quick on fxp0 proto tcp from any to any flags FUP

block in quick on fxp0 all with ipopts

block in quick on fxp0 proto icmp all icmp-type 8

block in quick on fxp0 proto tcp from any to any port = 113


block in log first quick on fxp0 proto tcp/udp from any to any port = 137
block in log first quick on fxp0 proto tcp/udp from any to any port = 138
block in log first quick on fxp0 proto tcp/udp from any to any port = 139
block in log first quick on fxp0 proto tcp/udp from any to any port = 81

pass in quick on fxp0 proto udp from 192.168.1.1 to any port = 68 keep state

#pass in quick on dc0 proto tcp from any to any port = 80 flags S keep state

pass in quick on fxp0 proto tcp from any to any port = 22 flags S keep state
.
block in log first quick on fxp0 all

################### End of rules file #####################################

/etc/ipnat.rules:

Code: 
map fxp0 10.0.0.2 -> 192.168.1.1 portmap tcp/udp 40000:65000
map fxp0 10.0.0.2 -> 192.168.1.1
rdr fxp0 0.0.0.0/0 port 80 -> 10.0.0.2 port 80
 
I think you have your ipnat.rules incorrectly setup. Try something like:

Code: 
map fxp0 10.0.0.0/24 -> fxp0/32 portmap tcp/udp 40000:65000
map fxp0 10.0.0.0/24 -> fxp0/32

I don't know about the rdr portion of it.
 
My setup

Hi,
I have a connection like this.

Code: 
Modem ---------- PC (FBSD) ------------- PC(Ubuntu)
(192.168.1.1)   (re0 - 192.168.1.2)      172.31.113.2   
                (rl0 - 172.31.113.1)


My relevant rc.conf
Code: 
gateway_enable="YES"
clear_temp_enable="YES"

dhcpd_enable="YES"
dhcpd_ifaces="rl0"

My basic pf.conf
Code: 
##MACROS
ext_if="re0"
int_if="rl0"
int_net="172.31.0.0/16"

##TRANSLATION RULES
nat on $ext_if from $int_net to any -> ($ext_if)

My FBSD has 2 NICs and I am running a dhcp server in rl0 interface to give ip address to my ubuntu pc.
Your case should not be much different from what i have give here. Instead of connecting directly to FBSD u have a switch in between and are connecting your other 2 PCs to it.
 
Gordon, I corrected my ipnat.rules file and I still can't get to the internet. The NIC card in my FreeBSD server that is connected to my FIOS modem/router (fxp0) is currently set for DHCP, but I noticed that the FIOS router always servers up the same IP address for that NIC: 192.168.1.4. Should I not set that NIC for DHCP? Should I just set the static address 192.168.1.4 on that NIC with a gateway of 192.168.1.1?
 
trybeingarun, does your modem serve up DHCP or does your internet provider assugn a static address? I assumed that I needed to set my outside facing NIC (fxp0) to DHCP. Should I set a static address for that NIC?
 
If your router is handing out 192.168.x.x addressing, it's already non-routed private IP space. It's not really recommended to be doing a double NAT as that can cause some wonkiness. I suspect you can just bridge the networks and give your internal PCs 192.168.x.x addresses and be done with it.
 
Hello

I don't know about those wonkinesses. I get 192.168.x.x address from router to my FreeBSD box which does NAT (or is the correct term PAT) for other PC and Playstation 3 with other private IP address range. I have not noticed any problems from double NAT.
 
Kiiski, could you post your rc.conf and ipnat.rules file (or whatever NAT rules file you may be using) so I could take a look?

Thanks.
 
Sure, here are parts of my rc.conf dealing with wired networking:

Code: 
gateway_enable="YES"
firewall_enable="YES"
firewall_type="OPEN"
natd_enable="YES"
natd_interface="pcn0"
natd_flags=""
ifconfig_nfe0="inet 172.16.0.2  netmask 255.255.255.248"
ifconfig_pcn0="DHCP"

nfe0 is network interface to other PC
pcn0 is network interface to router

I'm using generic kernel.
Lines related to NAT in /boot/loader.conf:

Code: 
ipfw_load="YES"
ipdivert_load="YES"

I'm using generic ipfw "OPEN" rule with natd enabled, so I have not done any own firewall rules.
Rules can be found from /etc/rc.firewall.

Hope I remembered everything. Do not hesitate to ask if you need some more information.
 
Unfortunately, none of this has worked. I changed the IP address numbering scheme for my LAN to use the 192.168.2.x range to see if that would make any difference and I changed my firewall back to IPFW from IPF and set it to OPEN as Kiiski suggested but to no avail. At this point, I have a second NIC in my Windows box so that I can at least get to the internet to get some work done, but I am working this issue on my Linux box with the one NIC attached to the switch which is then attached to the FreeBSD server. The issue is still as it has always been; cannot ping the FIOS modem router (192.168.1.1) from the Linux box (and windows box when it had the one NIC) through the FreeBSD server. The core issue remains that it still seems to be that the server is not bridging between the 192.168.1.1 router and the 192.168.2.x network at all.
This was suppose to be a straight-forward project to build a internet gateway for my home LAN, but has turned into anything but. At least gettting MySQL up and running was easier!
 
IMHO many times persons asking here are unaware that
there exist on the net many guides covering the issue(s)
in greater detail for freebsd. ( Particularly setup issues,
unlike more problematic ones...) For example, "freebsd routing
guide" without quotes in google, brings up
HTML: 
freebsd.rogness.net
and the section:)
"building a gateway router" which looks like it may hold
a clue to a fix here. Or at least help.
Sorry if rereading the posts would negate it...
 
jb, this is good stuff. I will study this site's information and report back what I find. Thanks for the tip!
 
The problem has been SOLVED! Thank you jb for pointing me to freebsd.rogness.net. The section on NATing was where the answer lay and in particular adding the
Code: 
options   IPDIVERT
to the kernel and rebuilding the kernel. Did the following;

Code: 
cd /sys/i386/conf
cp GENERIC LOCAL
vi LOCAL  (added "options        IPDIVERT")
then...

Code: 
config LOCAL
cd ../compile/LOCAL
make depend && make && make install

The build took about half an hour, but when it was done and I rebooted my server, PRESTO!! all of my client workstations could access the internet. I had a router and a gateway at last!!

Many thanks to all who helped with this including DutchDaemon and of course jb! You guys rock! Long Live FreeBSD!!
 
Get used to the more modern commands for building world and kernel. See /usr/src/Makefile for

* make buildworld
* make installworld
* make buildkernel
* make installkernel
 
You must log in or register to reply here.
Back
Top