apt-get dist-upgrade borked nat

rbees · 04-11-2014, 02:46 PM

Ladies & Gents,

It seams that apt-get dist-upgrade broked my system. I had a working external host that provided Internet, NAT, DHCP, cache-DNS, and Firewall to my internal network. The system was running Debian Squeeze. Now that Wheezy has been stable for a while I dicided to dist-upgrad the system to Wheezy. All went fine through the upgrade, it even rebooted without issue. But now NAT is not working.

I have enabled nat in /etc/sysctrl.conf net.ipv4.ip_forward=1

I have checked my firewall settings and they all seam to be fine, arno-iptables-firewall scripts.

I have checked my nic setting, they were not changed by the upgrade.

I have looked at every thing I can think of but all with no joy.

My internal network is working fine. Local name are resolving and I can ssh into the other hosts. But www.google.com will not resolve and trying to ping a random ip results in host not reachable. These conditions/results apply to the server as well as all the hosts hooked to the network it controls.

What am I missing?

And yes I have rebooted the machine on both kernels that are installed.

I think maybe the routing table is not being set up correctly. I don't have access to the machine at the moment to be able to post the table. But going on memory it seams to be a couple short on entries. The host has 2 active nic's.

Thanks.

rbees · 04-11-2014, 04:15 PM

The routing table

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         external.host   0.0.0.0         UG    0      0        0 eth1
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.7.0     *               255.255.255.224 U     0      0        0 eth1

The gateway should be on eth0 not on eth1.

JeremyBoden · 04-11-2014, 04:32 PM

A cheap consumer grade router will do nearly everything you are trying to do - including NAT, DHCP, DNS (not cached) and a basic firewall.

rbees · 04-11-2014, 04:48 PM

Thanks but no thanks. I have several of them already and I have no real confidence in the security they provide. Besides this host does other things that a plastic box router will not do simply because it has neither the processing power or an os that can be hacked to do what I want.