[sweetspot-users] Issues and doubts with Setting Up;

[Asoh F. <aso...@ya...>]

Greetings,
 
I am a Linux computer that runs Sweetspot with two interfaces [eth0 ] and [eth1]
Eth0 is  the uplink connected to the public network with IP: 192.168.0.200
Eth1 is the distribution point(inside interface) with IP : 192.168.5.1
 
 
This Linux computer is connect from the Eth1(network 192.168.5.0) to a Linksys router(OpenWrt WAN port) with a static IP address of 192.168.5.7.
 
This Linksys router has 4 ports which are two networks of 192.168.1.0  and  192.168.2.0
 
 
I have static routing on the Linux computer running Sweetspot which is:

up route add -net 192.168.2.0/24 gw 192.168.5.7 dev eth1
up route add -net 192.168.1.0/24 gw 192.168.5.7 dev eth1
 
The route works and I can access any IP from anywhere on the network.
 
 
Now according to Sweetspot, if I am to change the netmask of Eth1 to 255.255.255.255 , then this network wouldn't work under normal circumstances. How am I suppose to do that ?
 
 
And secondly, how am I suppose to set up the IPTABLES ? does Sweetspot do this automatically ?
because after running the “sweetspot”, I found no changes to the IPTABLES. Here is my configuration file please:

/////////////////////////////////////////////////////////////////////////////////////////////////
# Sweetspot daemon configuration
 
# inner interface name (which is close to users)
inner-interface eth1
 
# outer interface name (which is close to Internet)
outer-interface eth0
 
# user IP CIDR (addresses anyhow assigned to user computers)
#user-networks 127.0.0.0
user-networks 192.168.5.0/24 192.168.1.0/24 192.168.2.0/24
 
# SNAT public networks
snat-public-networks 192.168.0.200/24
 
# authentication server address
uam-server-address 127.0.0.1
 
# authentication server port
#uam-server-port 3993
 
# authentication server shared secret (auth client must have the same)
uam-secret 1234567890
 
# report UAM errors back to client (obsolete)
#uam-report-errors 1
 
# Detail file accounting
acct-detail-file /var/sweetspot/detail
 
# Interim accounting interval (in secs)
acct-interim-interval 300
 
# NAS-IP-Address to report in acct detail file
acct-nas-ip-address 127.0.0.1
 
# Packet filters directory
filter-dir /usr/local/etc/sweetspot/filters
 
# Captive filter
#filter-anonymous anonymous
//////////////////////////////////////////////////////////////////////////////////////////////////////
 
 
 
I pretty much don’t get anything in the logs. If I change the netmask to 255.255.255.255, there is no pinging anywhere !, If I leave it to 255.255.255.0 there is pinging but no captive control.

I have a script that if I run under normal circumstances to share internet with the networks that works flawlessly. Another doubt it, should this script be run ? or does Sweetspot does something similar ?

/////////////////////////////////////////////////////////////////////////////////
 
#!/bin/sh
echo -e "\n\nSETTING UP IPTABLES PROXY..."
 
INTIF="eth1"
 
#   Enter the external interface's designation for the
#   EXTIF variable:
 
EXTIF="eth0"

 #   IP address for the EXTIP variable:

EXTIP="192.168.0.200"
 

echo "Loading required stateful/NAT kernel modules..."
 
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
 
echo "    Enabling IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo "    External interface: $EXTIF"
echo "       External interface IP address is: $EXTIP"
echo "    Loading proxy server rules..."
 
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F
 
# FWD: Allow all connections OUT and only existing and related ones IN
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j$
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
 
# Enabling SNAT (MASQUERADE) functionality on $EXTIF
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
 
echo -e "       Proxy server rule loading complete\n\n"
 
/////////////////////////////////////////////////////////////////////////////////////////////