Menu
▾
▴
Re: [sweetspot-users] Issues with setting up
|
From: Asoh F. <aso...@ya...> - 2013-07-28 17:41:24
|
Thanks Ilya for taking your time to reply; I shall proceed as you advice. So you say it's ok for the inner interface to be 192.158.5.1 netmask 255.255.255.255, then the port of the router that connects to this interface should have e.g 192.168.5.2 netmask 255.255.255.0 ? or 255.255.255.255 ? Asoh Frank-Senior MSc. Computer Science University of Antwerpen Belgium ________________________________ From: Ilya Etingof <il...@gl...> To: swe...@li... Sent: Sunday, July 28, 2013 6:12 PM Subject: Re: [sweetspot-users] Issues with setting up Hi Frank, Please find my comments along the lines: On Jul 24, 2013, at 12:07 AM, <afr...@gm...> <afr...@gm...> wrote: > Greetings, > > I am a Linux computer that runs Sweetspot with two interfaces [eth0 ] and [eth1] > Eth0 is the uplink connected to the public network with IP: 192.168.0.200 > Eth1 is the distribution point(inside interface) with IP : 192.168.5.1 > > > This Linux computer is connect from the Eth1(network 192.168.5.0) to a Linksys router(OpenWrt WAN port) with a static IP address of 192.168.5.7. > > This Linksys router has 4 ports which are two networks of 192.168.1.0 and 192.168.2.0 > > > I have static routing on the Linux computer running Sweetspot which is: > > up route add -net 192.168.2.0/24 gw 192.168.5.7 dev eth1 > up route add -net 192.168.1.0/24 gw 192.168.5.7 dev eth1 > > The route works and I can access any IP from anywhere on the network. > > > Now according to Sweetspot, if I am to change the netmask of Eth1 to 255.255.255.255 , then this network wouldn't work under normal circumstances. How am I suppose to do that ? > In your setup it looks like this is not needed. The idea of a host netmask on inner interface is to disallow clients talking to each other through kernel (e.g. using regular routing). Since you have clients in a local segment behind router they would talk to each other anyway. But maybe that's not an issue. > And secondly, how am I suppose to set up the IPTABLES ? does Sweetspot do this automatically ? > because after running the “sweetspot”, I found no changes to the IPTABLES. Here is my configuration file please: Sweetspot does not use iptables. > ///////////////////////////////////////////////////////////////////////////////////////////////// > # Sweetspot daemon configuration > > # inner interface name (which is close to users) > inner-interface eth1 > > # outer interface name (which is close to Internet) > outer-interface eth0 > > # user IP CIDR (addresses anyhow assigned to user computers) > #user-networks 127.0.0.0 > user-networks 192.168.5.0/24 192.168.1.0/24 192.168.2.0/24 > > # SNAT public networks > snat-public-networks 192.168.0.200/24 > > # authentication server address > uam-server-address 127.0.0.1 > > # authentication server port > #uam-server-port 3993 > > # authentication server shared secret (auth client must have the same) > uam-secret 1234567890 > > # report UAM errors back to client (obsolete) > #uam-report-errors 1 > > # Detail file accounting > acct-detail-file /var/sweetspot/detail > > # Interim accounting interval (in secs) > acct-interim-interval 300 > > # NAS-IP-Address to report in acct detail file > acct-nas-ip-address 127.0.0.1 > > # Packet filters directory > filter-dir /usr/local/etc/sweetspot/filters > > # Captive filter > #filter-anonymous anonymous > ////////////////////////////////////////////////////////////////////////////////////////////////////// > > > > I pretty much don’t get anything in the logs. If I change the netmask to 255.255.255.255, there is no pinging anywhere !, If I leave it to 255.255.255.0 there is pinging but no captive control. Your setup looks good. There should be no Internet available through your Linux computer if you disable IP forwarding: echo 0 > /proc/sys/net/ipv4/ip_forward Then the only way for packets to travel between eth1 and eth0 if through the sweetspot daemon. > > I have a script that if I run under normal circumstances to share internet with the networks that works flawlessly. Another doubt it, should this script be run ? or does Sweetspot does something similar ? Sweetspot does source and destination NAT all by itself. You don't need iptable here. -ilya ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ sweetspot-users mailing list swe...@li... https://lists.sourceforge.net/lists/listinfo/sweetspot-users |
