From owner-freebsd-questions Thu Mar 30 5:43:56 2000 Delivered-To: freebsd-questions@freebsd.org Received: from firehouse.net (spook.networkoperations.com [209.42.203.59]) by hub.freebsd.org (Postfix) with SMTP id DED2C37B75A for ; Thu, 30 Mar 2000 05:43:51 -0800 (PST) (envelope-from abc@firehouse.net) Received: (qmail 8424 invoked by uid 100); 30 Mar 2000 13:43:50 -0000 Date: Thu, 30 Mar 2000 08:43:50 -0500 From: Alan Clegg To: cjclark@home.com Cc: freebsd-questions@FreeBSD.ORG Subject: Re: natd with three interfaces. Message-ID: <20000330084350.F3459@laptop.firehouse.net> References: <20000329224805.C3459@laptop.firehouse.net> <20000330004610.D17852@cc942873-a.ewndsr1.nj.home.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="5CUMAwwhRxlRszMD" X-Mailer: Mutt 1.0.1i In-Reply-To: <20000330004610.D17852@cc942873-a.ewndsr1.nj.home.com>; from cjc@cc942873-a.ewndsr1.nj.home.com on Thu, Mar 30, 2000 at 12:46:10AM -0500 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG --5CUMAwwhRxlRszMD Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Out of the ether, Crist J. Clark spewed forth the following bitstream: > On Wed, Mar 29, 2000 at 10:48:05PM -0500, Alan Clegg wrote: > > I have a machine with three interfaces, wireless (wi0) internal (fxp0) = and > > external (dc0). > >=20 > > Now, I have natd running as such: > > /sbin/natd -n dc0 > > with: > > /sbin/ipfw -f flush > > /sbin/ipfw add divert natd all from any to any via dc0 > > /sbin/ipfw add pass all from any to any > > Forwarding is turned on, and everything is OK as long as machines are g= oing > > out from wireless or internal to the outside world. My problem occurs = when > > I try to go from inside to wireless or vice-versa. =20 > What kinds of "problems" are these? I think we need some more info. Urk. I guess that would help... Well, the problem was asymetrical routing on the WIRED side. There were actually *TWO* machines acting in the "RTR" role below, one of which was acting JUST FINE, and the other that was being stubborn. I was, of-course, looking at the one that was JUST FINE and all of the problems went away when I fixed the default route on the WIRED machines. See text below that I typed while trying to figure it out.... Here is what I had typed so-far (but since I fixed it, nevermind).=20 ------------------SNIP--------------------------SNIP ------------------ Here's what's happening: +-------+ + world + +-------+ | +-------+ +------+ | RTR |-+-+-+-| WRLS | +-------+ +------+ | +-------+ | WIRED | +-------+ world =3D=3D internet via ISDN RTR is a system with: dc0: flags=3D8843 mtu 1500 inet 219.43.207.59 netmask 0xfffffff0 broadcast 219.43.207.63 (pointing to world) fxp0: flags=3D8843 mtu 1500 inet 10.0.0.52 netmask 0xffffff00 broadcast 10.0.0.255 (pointing to wired) wi0: flags=3D8843 mtu 1500 inet 10.100.100.10 netmask 0xffffff00 broadcast 10.100.100.255 (pointing to WRLS) WIRED is a lan, including a machine with: ed0: flags=3D8843 mtu 1500 inet 10.0.0.192 netmask 0xffffff00 broadcast 10.0.0.255 WRLS is a wireless LAN, including a machine with: wi0: flags=3D8843 mtu 1500 inet 10.100.100.192 netmask 0xffffff00 broadcast 10.100.100.192 A ping from WRLS to WIRED generates icmp echo packets that travel (and are visible with tcpdump) on WRLS->RTR->WIRED {WIRED 3} tcpdump -n -i ed0 icmp tcpdump: listening on ed0 08:25:18.648561 10.100.100.192 > 10.0.0.192: icmp: echo request 08:25:18.648703 10.0.0.192 > 10.100.100.192: icmp: echo reply 08:25:18.649294 10.0.0.192 > 10.100.100.192: icmp: echo reply Note the DOUBLING of the icmp echo replies. At the same time, a tcpdump on the WRLS side sees: WRLS 39} tcpdump -i wi0 -n icmp tcpdump: listening on wi0 08:26:40.674098 10.100.100.192 > 10.0.0.192: icmp: echo request 08:26:41.797599 10.100.100.192 > 10.0.0.192: icmp: echo request 08:26:42.927648 10.100.100.192 > 10.0.0.192: icmp: echo request Note, no replies. RTR sees: RTR 102} tcpdump -n -i wi0 icmp tcpdump: listening on wi0 08:27:43.951529 10.100.100.192 > 10.0.0.192: icmp: echo request 08:27:44.947051 10.100.100.192 > 10.0.0.192: icmp: echo request 08:27:46.077075 10.100.100.192 > 10.0.0.192: icmp: echo request RTR 103} tcpdump -n -i fxp0 icmp tcpdump: listening on fxp0 08:28:25.648322 10.100.100.192 > 10.0.0.192: icmp: echo request 08:28:25.648780 10.0.0.192 > 10.100.100.192: icmp: echo reply 08:28:25.649239 10.0.0.192 > 10.100.100.192: icmp: echo reply 08:28:26.788361 10.100.100.192 > 10.0.0.192: icmp: echo request 08:28:26.788832 10.0.0.192 > 10.100.100.192: icmp: echo reply 08:28:26.789342 10.0.0.192 > 10.100.100.192: icmp: echo reply Looking at the echo replies shows that one is being generated by AlanC --5CUMAwwhRxlRszMD Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: 7IBR2i0yJVlYekICAHQkHHaN5mWqEmBw iQA/AwUBOONaFfcyv/gweBpYEQLgHACgxZTRlgZBdyqzBA3B+osm+mTxB1IAoJ7z GDyJlp/hXwndLWSmCjV+xuLk =5+1p -----END PGP SIGNATURE----- --5CUMAwwhRxlRszMD-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message