I am having problems setting up a debian gateway server. My goal:
eth1the WAN interface.
eth0the LAN interface.
- Allow both ports 22 (SSH) and 80 (HTTP) accessed from the outside world on the gateway (SSH and HTTP run on this server).
What I did was the following:
- Create a file
*nat -A POSTROUTING -o eth1 -j MASQUERADE COMMIT *filter -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth1 -j DROP COMMIT
- edit /etc/network/interfaces as follows:
# The loopback network interface auto lo iface lo inet loopback pre-up iptables-restore < /etc/iptables.rules auto eth0 allow-hotplug eth0 iface eth0 inet dhcp #auto eth1 #allow-hotplug eth1 #iface eth1 inet dhcp allow-hotplug eth1 iface eth1 inet static address 220.127.116.11 netmask 255.255.255.248 gateway 18.104.22.168 dns-nameservers 22.214.171.124 126.96.36.199
- Uncomment the rule
/etc/sysctl.confto allow packet forwarding.
The static settings for eth1 such as the ip address I got from my router (which I want to replace); I simply copied these.
I have a (windows) DNS + DHCP server on ip address 10.180.1.10, which assigns ip address 10.180.1.44 to eth0. What this server does is not really interesting it only maps domain names on our local network and assigns one static ip to the gateway.
What works: on the gateway itself I can ping
google.nl. So that is okey.
What does not work:
(1)Every machine connected to
eth0(indirectly via a switch) can not ping an ip or a domain. So I guess the gateway can not be found.
(2)Also when I configure my linux machine (a laptop) to use a static ip 10.180.1.41, a mask and a gateway (10.180.1.44) I can not ping an ip or domain either.
This means that maybe my iptables is incorrect of not loaded correctly. Or I maybe have to configure my DNS/DHCP on my windows machine. I have not reset the windows machine net, restart the DNS/DHCP services, should I do this?
- I did not install
dnsmasqas desribed here: http://blog.noviantech.com/2010/12/22/debian-router-gateway-in-15-minutes/. I don't think this is necessary?