Re: [sweetspot-users] Issues with setting up

[Ilya E. <il...@gl...>]

Hi Frank,

Please find my comments along the lines:

On Jul 24, 2013, at 12:07 AM, <afr...@gm...> <afr...@gm...> wrote:

> Greetings,
>  
> I am a Linux computer that runs Sweetspot with two interfaces [eth0 ] and [eth1]
> Eth0 is  the uplink connected to the public network with IP: 192.168.0.200
> Eth1 is the distribution point(inside interface) with IP : 192.168.5.1
>  
>  
> This Linux computer is connect from the Eth1(network 192.168.5.0) to a Linksys router(OpenWrt WAN port) with a static IP address of 192.168.5.7.
>  
> This Linksys router has 4 ports which are two networks of 192.168.1.0  and  192.168.2.0
>  
>  
> I have static routing on the Linux computer running Sweetspot which is:
> 
> up route add -net 192.168.2.0/24 gw 192.168.5.7 dev eth1
> up route add -net 192.168.1.0/24 gw 192.168.5.7 dev eth1
>  
> The route works and I can access any IP from anywhere on the network.
>  
>  
> Now according to Sweetspot, if I am to change the netmask of Eth1 to 255.255.255.255 , then this network wouldn't work under normal circumstances. How am I suppose to do that ?
>  

In your setup it looks like this is not needed. The idea of a host netmask on inner interface is to disallow clients talking to each other through kernel (e.g. using regular routing). Since you have clients in a local segment behind router they would talk to each other anyway. But maybe that's not an issue.

> And secondly, how am I suppose to set up the IPTABLES ? does Sweetspot do this automatically ?
> because after running the “sweetspot”, I found no changes to the IPTABLES. Here is my configuration file please:

Sweetspot does not use iptables.

> /////////////////////////////////////////////////////////////////////////////////////////////////
> # Sweetspot daemon configuration
>  
> # inner interface name (which is close to users)
> inner-interface eth1
>  
> # outer interface name (which is close to Internet)
> outer-interface eth0
>  
> # user IP CIDR (addresses anyhow assigned to user computers)
> #user-networks 127.0.0.0
> user-networks 192.168.5.0/24 192.168.1.0/24 192.168.2.0/24
>  
> # SNAT public networks
> snat-public-networks 192.168.0.200/24
>  
> # authentication server address
> uam-server-address 127.0.0.1
>  
> # authentication server port
> #uam-server-port 3993
>  
> # authentication server shared secret (auth client must have the same)
> uam-secret 1234567890
>  
> # report UAM errors back to client (obsolete)
> #uam-report-errors 1
>  
> # Detail file accounting
> acct-detail-file /var/sweetspot/detail
>  
> # Interim accounting interval (in secs)
> acct-interim-interval 300
>  
> # NAS-IP-Address to report in acct detail file
> acct-nas-ip-address 127.0.0.1
>  
> # Packet filters directory
> filter-dir /usr/local/etc/sweetspot/filters
>  
> # Captive filter
> #filter-anonymous anonymous
> //////////////////////////////////////////////////////////////////////////////////////////////////////
>  
>  
>  
> I pretty much don’t get anything in the logs. If I change the netmask to 255.255.255.255, there is no pinging anywhere !, If I leave it to 255.255.255.0 there is pinging but no captive control.

Your setup looks good.

There should be no Internet available through your Linux computer if you disable IP forwarding:

echo 0 > /proc/sys/net/ipv4/ip_forward 

Then the only way for packets to travel between eth1 and eth0 if through the sweetspot daemon. 

> 
> I have a script that if I run under normal circumstances to share internet with the networks that works flawlessly. Another doubt it, should this script be run ? or does Sweetspot does something similar ?

Sweetspot does source and destination NAT all by itself. You don't need iptable here.

-ilya