[Asterisk-Users] Routing packets in and out

[Christian Hoffmeyer]

Hello * community,

I have 2 * boxes spanning a t1 with hdlc.

I'm trying to route packets so people on a subnet seperate of the * boxes
can browse the boxes on the * spanned subnet.

The * boxes and the boxes on subnet controlled by * can see everything.  The
boxes on the seperate subnet inside the company can only see so far as the
first * box and can't ping across the span.

http://home.yottadot.org/christian/

I have two boxes on a span that are routing packets perfectly amongst
themselves both ways and from internal to external just fine.  What they're
not doing in routing externally originating packets between themselves
properly.  Packets can get to the head box and I can hit both of it's
interfaces, but I can't hit either of the interfaces on the second box.

I can hit either interface on each box from either box.  I can hit any
external interface on the network and internet from either box.  I can only
hit both interfaces on the first box from the internal network and nothing
on the second box or the boxes that the second box is the subnet gateway
for.  I have no way of testing if the lead box can ping a box on the .10
subnet which will be illustrated below, so I don't know if the packets are
routing correctly there, but I doubt they are.

Any hints would be appreciated:



christian at yottadot.org


routing table from first box:

192.168.1.0     192.168.253.254 255.255.255.0   UG    0      0        0 eth0

192.168.10.0    192.168.254.1   255.255.255.0   UG    0      0        0
hdlc0

localnet        *               255.255.255.0   U     0      0        0 eth0

192.168.254.0   *               255.255.255.0   U     0      0        0
hdlc0

loopback        *               255.0.0.0       U     0      0        0 lo

default         192.168.253.254 0.0.0.0         UG    1      0        0 eth0

-------------------------------------------------------------
firewall from first box:

#!/bin/bash



IPTABLES=/usr/sbin/iptables

#IPTABLES=echo



EXTIF="eth0"

INTIF="hdlc0"



echo "    External Interface:  $EXTIF"

echo "    Internal Interface:  $INTIF"



echo " Clearing existing rules"

$IPTABLES -P INPUT ACCEPT

$IPTABLES -F INPUT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -F OUTPUT

$IPTABLES -P FORWARD ACCEPT

$IPTABLES -F FORWARD

$IPTABLES -F Allow

$IPTABLES -X Allow

$IPTABLES -t nat -F



echo " Setting up packet routing"

$IPTABLES -N Allow

$IPTABLES -A Allow -m state --state ESTABLISHED,RELATED -i $INTIF -j ACCEPT

$IPTABLES -A Allow -m state --state ESTABLISHED,RELATED -i $EXTIF -j ACCEPT

$IPTABLES -A Allow -m state --state NEW -i $INTIF -j ACCEPT

$IPTABLES -A Allow -m state --state NEW -i $EXTIF -j ACCEPT





echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF and $INTIF"

$IPTABLES -t nat -A POSTROUTING -o $INTIF -j MASQUERADE

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE



echo "1" > /proc/sys/net/ipv4/ip_forward

-------------------------------------------------------------
routing table on second box:

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface

localnet        Avion_Asterisk_ 255.255.255.0   UG    0      0        0 eth0

localnet        *               255.255.255.0   U     0      0        0 eth0

192.168.253.0   192.168.254.1   255.255.255.0   UG    0      0        0
hdlc0

192.168.254.0   192.168.254.1   255.255.255.0   UG    0      0        0
hdlc0

192.168.254.0   *               255.255.255.0   U     0      0        0
hdlc0

loopback        *               255.0.0.0       U     0      0        0 lo

default         192.168.254.1   0.0.0.0         UG    0      0        0
hdlc0

-------------------------------------------------------------
firewall on second box:

#!/bin/bash



IPTABLES=/usr/sbin/iptables

#IPTABLES=echo



EXTIF="hdlc0"

INTIF="eth0"



echo "    External Interface:  $EXTIF"

echo "    Internal Interface:  $INTIF"



echo " Clearing existing rules"

$IPTABLES -P INPUT ACCEPT

$IPTABLES -F INPUT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -F OUTPUT

$IPTABLES -P FORWARD ACCEPT

$IPTABLES -F FORWARD

$IPTABLES -F Allow

$IPTABLES -X Allow

$IPTABLES -t nat -F



echo " Setting up packet routing"

$IPTABLES -N Allow

$IPTABLES -A Allow -m state --state ESTABLISHED,RELATED -i $INTIF -j ACCEPT

$IPTABLES -A Allow -m state --state ESTABLISHED,RELATED -i $EXTIF -j ACCEPT

$IPTABLES -A Allow -m state --state NEW -i $INTIF -j ACCEPT

$IPTABLES -A Allow -m state --state NEW -i $EXTIF -j ACCEPT





echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF and $INTIF"

$IPTABLES -t nat -A POSTROUTING -o $INTIF -j MASQUERADE

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE



echo "1" > /proc/sys/net/ipv4/ip_forward

-------------------------------------------





Here's the chart - I need to be able to ping boxes both ways across the
span:

           router / gateway ( .1.254 )
                      |
               ----------
               |      |       |
         |---       |        -----------------External
         |           |
(.1.0 sub)      |
                     |
             (.253.254)
                      |
                      |
         (.253.253) -----same box --->(.254.1)
                                                           |
                                                           |
            --t1 span to another building----
             |
      (.254.2)---same box---->---(.10.254)
                                                       |
                                                       |
                                            (.10.0 subnet)





Thanks for even looking,



Christian



christian at yottadot.org