Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My configuration:

  • Ubuntu 12.04
  • DHCP3-server
  • BIND9
  • eth0, eth1, eth2

eth0 is the external connection
eth1 & eth2 are the internal network

eth1 and eth2 are supposed to be seperate networks of student/teachers respectivly.

What I would like to have is the internet from external device bridged to device 1 and 2, with the DHCP server controlling the two internal devices. Its already working with DHCP, the part I am stuck on is bridging for internet.

I have setup a script that I found here: Router
With the original script he linked here: Ubuntu Router Guide

removed the old configs, not sure they were still accurate

If you need more information please just let me know.

EDIT:

So I had a 255.255.254.0 network, I believe that was causing the issue. Not sure if it will matter on the second card, I will test later.

After changing the subnet to 255.255.255.0 the pings will pass through, however, I cannot get DNS requests to pass?

My new Config for Firewall Rules Updated


# Generated by iptables-save v1.4.12 on Thu Dec  6 20:15:11 2012
*nat
:INPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j SNAT --to-source 192.168.11.1-192.168.11.254
-A POSTROUTING -o eth0 -j SNAT --to-source 192.168.25.1-192.168.25.254
COMMIT
# Completed on Thu Dec  6 20:15:11 2012
# Generated by iptables-save v1.4.12 on Thu Dec  6 20:15:11 2012
*mangle
:PREROUTING ACCEPT [9:1591]
:INPUT ACCEPT [9:1591]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:3498]
:POSTROUTING ACCEPT [6:3498]
COMMIT
# Completed on Thu Dec  6 20:15:11 2012
# Generated by iptables-save v1.4.12 on Thu Dec  6 20:15:11 2012
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# WAN to LAN
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
# WAN to LAN
-A FORWARD -m state -i eth0 -o eth2 --state ESTABLISHED,RELATED -j ACCEPT
# LAN to WAN
-A FORWARD -m state -i eth1 -o eth0 --state NEW,ESTABLISHED,RELATED -j ACCEPT
# LAN to WAN
-A FORWARD -m state -i eth2 -o eth0 --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Log
-A FORWARD -j LOG
COMMIT
# Completed on Thu Dec  6 20:15:11 2012

Not sure what else you may need, but I am using Webmin to control the server(Needed for the operators on site to know how to use it.)

If you could explain it as standard CLI commands, or edits to this file directly then we should be ok. :)

And thanks again Erik, I do believe your edits did help.

Most Recent Edits

    root@LFBC-US01:~# ip route
    default via 192.168.1.1 dev eth0  metric 100
    192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.25
    192.168.11.0/24 dev eth1  proto kernel  scope link  src 192.168.11.1
    192.168.25.0/24 dev eth2  proto kernel  scope link  src 192.168.25.1
    root@LFBC-US01:~#

According to my understanding this represents the routes in my server, for some reason the DNS will not pass through, and pings to google on my windows 7 machine do not pass through. Any suggestions?

My Interfaces settings

auto lo eth0 eth1 eth2
iface lo inet loopback

iface eth0 inet dhcp
    dns-nameservers 208.67.222.123 208.67.220.123 8.8.8.8 8.8.4.4

iface eth1 inet static
    address 192.168.11.1
    netmask 255.255.255.0
    broadcast 192.168.11.255
    network 192.168.11.0

iface eth2 inet static
        address 192.168.25.1
        netmask 255.255.255.0
        broadcast 192.168.25.255
        network 192.168.25.0

And finally my DHCP.conf

ddns-update-style none;

default-lease-time 7000;
max-lease-time 7200;

log-facility local7;

# Student Network
subnet 192.168.11.0 netmask 255.255.255.0 {
    option domain-name-servers 192.168.11.1;
    range 192.168.11.2 192.168.11.252;
    option routers 192.168.11.1;
    option broadcast-address 192.168.11.255;
    }
# Teacher Network
subnet 192.168.25.0 netmask 255.255.255.0 {
    option domain-name-servers 192.168.25.1;
    range 192.168.25.2 192.168.25.252;
    option routers 192.168.25.1;
    option broadcast-address 192.168.25.255;
    }
share|improve this question
    
What do you mean by "bridging for internet", does that mean that you are stuck on having letting people surf through your router? Bridging means that you will use one of those br0 interfaces to let people get DHCP from your internet provider instead of your server. –  Erik Johansson Nov 24 '12 at 18:44
    
I will have to remove the Bridges because if you are correct then this is not what I wanted. I do however want the internet to be forwarded to the two lan ports with the server giving out DHCP. –  cengbrecht Nov 27 '12 at 18:16
    
Addendum:I re-used my question so that I could prevent Zombies, and also help someone else with this curiosity. –  cengbrecht Nov 29 '12 at 3:37
    
Back after a nice weekend. :-) I see nothing that is blocking UDP in your firewall rules, try running "dig google.com @8.8.8.8" from a client on the network.. if you still have problems you can install dnsmasq. –  Erik Johansson Dec 4 '12 at 11:06

1 Answer 1

up vote 0 down vote accepted

I think you can just follow the section on enabling forward and masquerading (4.5) but you need to add this:

First uncomment INTIF2 so you have::

INTIF=eth1
INTIF2=eth0

Add lines for INTIF2 in the firewall script (just copy the $INTIF lines and change $INTIF to $INTIF2):

-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 
-A FORWARD -i "$INTIF" -o "$EXTIF" -j ACCEPT
-A FORWARD -i "$EXTIF" -o "$INTIF2" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 
-A FORWARD -i "$INTIF2" -o "$EXTIF" -j ACCEPT

edit and as always you have to enable forwarding of the traffic, but that is done if you use the script in the manual linked above.

echo "1" > /proc/sys/net/ipv4/ip_forward

share|improve this answer
    
Thanks for your information there Erik, I will give this a go when I have time at home. Sorry about the clarifications. Yes, I was just trying to forward the internet, not DHCP, this computer is going to be the local DHCP for the two lan Ports, I did not want the two ports to see eachother, and I believe that I have that already setup. Thanks for all your help. –  cengbrecht Nov 27 '12 at 18:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.