Hello.
I setup and install ubuntu server, and try share internet connection, but I have strange problem.
I have tow interfaces:
ppp0 (internet)
ath0 (wi-fi, work in master mode)
When computer connect by wi-fi to server it get ip setting by DHCP. I use iptable for sharing connetction.
Some configs:
This script start automatically:
Code:
#!/bin/sh
IPT="/sbin/iptables"
# The network interface you will use
# WAN is the one connected to the internet
# LAN the one connected to your local network
WAN="ppp0"
LAN="ath0"
# First we need to clear up any existing firewall rules
# and chain which might have been created
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X
# Default policies: Drop any incoming packets
# accept the rest.
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
# Masquerading will make machines from the LAN
# look like if they were the router
$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE
# If you want to allow traffic to specific port to be
# forwarded to a machine from your LAN
# here we forward traffic to an HTTP server to machine 192.168.0.2
#$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to 192.168.0.2:80
#$IPT -A FORWARD -i $WAN -p tcp --dport 80 -m state --state NEW -j ACCEPT
# For a whole range of port, use:
#$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 1200:1300 -j DNAT --to 192.168.0.2
#$IPT -A FORWARD -i $WAN -p tcp --dport 1200:1300 -m state --state NEW -j ACCEPT
# Do not allow new or invalid connections to reach your internal network
$IPT -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP
# Accept any connections from the local machine
$IPT -A INPUT -i lo -j ACCEPT
# plus from your local network
$IPT -A INPUT -i $LAN -j ACCEPT
# Here we define a new chain which is going to handle
# packets we don't want to respond to
# limit the amount of logs to 10/min
$IPT -N Firewall
$IPT -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Firewall: "
$IPT -A Firewall -j DROP
# log those packets and inform the sender that the packet was rejected
$IPT -N Rejectwall
$IPT -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectwall: "
$IPT -A Rejectwall -j REJECT
# use the following instead if you want to simulate that the host is not reachable
# for fun though
#$IPT -A Rejectwall -j REJECT --reject-with icmp-host-unreachable
# here we create a chain to deal with unlegitimate packets
# and limit the number of alerts to 10/min
# packets will be drop without informing the sender
$IPT -N Badflags
$IPT -A Badflags -m limit --limit 10/minute -j LOG --log-prefix "Badflags: "
$IPT -A Badflags -j DROP
# A list of well known combination of Bad TCP flags
# we redirect those to the Badflags chain
# which is going to handle them (log and drop)
$IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j Badflags
$IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j Badflags
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j Badflags
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j Badflags
$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j Badflags
# Accept certain icmp message, drop the others
# and log them through the Firewall chain
# 0 => echo reply
$IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
# 3 => Destination Unreachable
$IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
# 11 => Time Exceeded
$IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
# 8 => Echo
# avoid ping flood
$IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPT -A INPUT -p icmp -j Firewall
# Accept ssh connections from the Internet
# $IPT -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT
# or only accept from a certain ip
#$IPT -A INPUT -i $WAN -s 125.124.123.122 -p tcp --dport 22 -j ACCEPT
# Accept related and established connections
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Drop netbios from the outside, no log, just drop
$IPT -A INPUT -p udp --sport 137 --dport 137 -j DROP
# Finally, anything which was not allowed yet
# is going to go through our Rejectwall rule
$IPT -A INPUT -j Rejectwall
Here is interfaces config:
Code:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# Onboard ethernet controller
# auto eth0
# iface eth0 inet static
# address 192.168.1.1
# netmask 255.255.0.0
# Wi-fi card setup
auto ath0
iface ath0 inet static
hostapd -B /etc/hostapd/hostapd.conf
address 192.168.0.3
netmask 255.255.255.0
madwifi-base wifi0
madwifi-mode ap
# PPPoE connection
auto eth0
iface eth0 inet manual
auto dsl-provider
iface dsl-provider inet ppp
re-up /sbin/ifconfig eth0 up # line maintained by pppoeconf
pon dsl-provider
And all work almost ideal except one thing: I can't get access to some site form remote computers(computers in local network).
Now I find 3 sites(maybe there is more):
mail.ru
microsoft.com
yahoo.com
When I try get access to them from server(w3m mail.ru or w3m microsoft.com) all works. But when I open browser and try open this site on remote computer (I have 3 and test at them all) they don't opens.
Code:
On remote:
Tracing route to yahoo.com [209.131.36.159]
over a maximum of 30 hops:
1 3 ms 1 ms 1 ms SFAM [192.168.0.3]
2 2 ms 1 ms 1 ms 10.254.254.254
3 6 ms 4 ms 56 ms rt4.net208.omkc.ru [217.25.208.141]
4 4 ms 2 ms 4 ms rt5.omkc.ru [217.25.208.1]
5 2 ms 2 ms 2 ms rt1.omkc.ru [217.25.208.161]
6 2 ms 2 ms 2 ms ge0-1-168.ll-omk.zsttk.ru [81.1.224.33]
7 3 ms 6 ms 1 ms omk15.transtelecom.net [217.150.37.34]
8 101 ms 102 ms 102 ms lnn11-ge500.501.transtelecom.net [195.66.224.212]
9 107 ms 107 ms 110 ms ge-1-1-0.pat1.the.yahoo.com [195.66.224.129]
10 180 ms 181 ms 181 ms so-2-1-0-pat1.nyc.yahoo.com [66.196.65.13]
11 182 ms 195 ms 181 ms ge-3-0-0.pat2.nyc.yahoo.com [216.115.111.66]
12 199 ms 193 ms 197 ms so-6-1-0.pat1.che.yahoo.com [216.115.101.158]
13 250 ms 250 ms 250 ms as1.pat1.dnx.yahoo.com [216.115.96.34]
14 248 ms * 247 ms as0.pat1.sjc.yahoo.com [216.115.101.149]
15 295 ms 290 ms 248 ms ae1-p170.msr2.sp1.yahoo.com [216.115.107.85]
16 255 ms 244 ms 245 ms te-9-1.bas-a1.sp1.yahoo.com [209.131.32.21]
17 294 ms 246 ms 293 ms b1.www.vip.sp1.yahoo.com [209.131.36.159]
Code:
On remote:
Pinging yahoo.com [209.191.93.53] with 32 bytes of data:
Reply from 209.191.93.53: bytes=32 time=218ms TTL=54
Reply from 209.191.93.53: bytes=32 time=217ms TTL=54
Reply from 209.191.93.53: bytes=32 time=217ms TTL=54
Reply from 209.191.93.53: bytes=32 time=218ms TTL=54
All other site works (google.com, ununtu.com, skype.com, developer.yahoo.com etc) both from server and from remote.
I really don't know why it is heppend, but I am sure that problem in server config. Please help.
Ask additional info if needed.
Bookmarks