Dotaz: Nefunkčný sieťový most

[rastislav]

Ahoj. Mám v PC s wifi Atheros a sieťovou kartou Realtek, distro Ubuntu 7.10. Od ISP mam pridelených viac IP adries pre ďalší PC a NTB. Vo svojom PC som vytvoril bridge cez brtcl a spojil wifi ath0 so sieťovkou eth0 do mostu. Problem je v tom, že ostatné PC a NTB nepingnu bránu a nemaju funkčné pripojenie na NET. Nechcem to riešiť cez zdieľanie z dôvodu pridelenia IP pre PC a NTB od ISP. Za vaše rady vopred ďakujem.

Odpovědi

[aa]

Reseni pres bridge vypada rozume. Zprovoznit ho znamena par radku v /etc/network/interfaces. Jak jsi to vlastne zprovoznoval ty? Neni to jen nejaka malickost, jako blbe zapnuty firewall?

[rastislav]

Mam to nastavene takto :

auto lo
iface lo inet loopback


iface ath0 inet static
#address 192.168.1.240
#netmask 255.255.255.0
#gateway 192.168.1.100
address 0.0.0.0
netmask 255.255.255.0
wireless-essid Kvetna

auto ath0

#iface br0 inet static
#pre-up brctl addbr br0
#pre-up brctl addif br0 ath0
#pre-up brctl addif br0 eth0
#address 192.168.1.240
#netmask 255.255.255.0
#broadcast 192.168.1.255
#gateway 192.168.1.100

iface br0 inet static
bridge_ports ath0 eth0
address 192.168.1.240
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.100

auto br0

iface eth0 inet static
address 0.0.0.0
netmask 255.255.255.0

auto eth0

[rastislav]

a ešte firewall som nenastavoval lebo neviem ako

[houska]

ebtables

[marekb]

Mohl byste sem jeste poslat konkretni adresaci, kterou mate od ISP a kterou mate na jednotlivych PC ?

M.

[rastislav]

Od ISP mam vyhradené IP od 192.168.1.240-250.

PC 1 :

address 192.168.1.241
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.100

PC 2 :

address 192.168.1.242
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.100

Môj PC :

address 192.168.1.240
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.100

[marekb]

Kdyz sundate nastaveni IP ze vzniknuteho br0 rozhrani, tak vam PC a NTBk predpokladam funguje .. Je to tak ?

MB

[rastislav]

ak nazdielam net tak to ide bez problemov

[marekb]

Tim nasdilenim predpokladam myslite klasicky NAT/masquerading.. Ten delate jak ? Nejakym "udelatkem", nebo rucne pomoci iptables ?

Ja jsem myslel vyzkouset, jestli bude fungovat PC a NTBk, kdyz nenastavite na br0 zadne IP parametry..

Jeste me napada - neblokuje Vas ISP MAC adresy ? Po nahozeni bridge muze byt urcita prodleva, nez zacnou pingy prochazet - ta prodleva je zpusobena MAC learningem bridge, muze to byt klidne i 30sec..

M.

[houska]

prosim:

brctl show
ip address list
ip route list

[rastislav]

brctl show

bridge name     bridge id               STP enabled     interfaces
br0             8000.000fa31cc4cc       no              ath0
                                                        eth0

ip address list

1: lo: LOOPBACK,UP,10000 mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: BROADCAST,MULTICAST,UP,10000 mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0f:ea:6a:96:a5 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20f:eaff:fe6a:96a5/64 scope link 
       valid_lft forever preferred_lft forever
3: ath0: BROADCAST,MULTICAST,UP,10000 mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0f:a3:1c:c4:cc brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20f:a3ff:fe1c:c4cc/64 scope link 
       valid_lft forever preferred_lft forever
4: br0: BROADCAST,MULTICAST,UP,10000 mtu 1500 qdisc noqueue 
    link/ether 00:0f:a3:1c:c4:cc brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.240/24 brd 192.168.1.255 scope global br0
    inet6 fe80::20f:a3ff:fe1c:c4cc/64 scope link 
       valid_lft forever preferred_lft forever

ip route list

192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.240 
169.254.0.0/16 dev br0  scope link  metric 1000 
default via 192.168.1.100 dev br0  metric 100 

MAC nie je blokované

[houska]

nemely by ty rozhrani byt v promiskuitnim rezimu?
co je zac tohle?

169.254.0.0/16 dev br0  scope link  metric 1000

z toho notebooku ti jde ping na 192.168.1.240?

[houska]

co ti rika traceroute z notebooku i PC s bridgem na nejakou vnejsi ip adresu? treba na 213.29.7.27

[rastislav]

traceroute z môjho PC :

traceroute to 213.29.7.27 (213.29.7.27), 30 hops max, 40 byte packets
 1  my.router (192.168.1.100)  29.582 ms  29.531 ms  29.706 ms

Na ntb je win (manželka :) ) ale ping na môj PC ide. A ešte na mojom PC ide všetko v pohode.

[rastislav]

Ešte výpis z dreamboxu je tiež v sieti :

root@dm7020:~> traceroute 213.29.7.27
traceroute to 213.29.7.27 (213.29.7.27), 30 hops max, 38 byte packets
 1  192.168.1.156 (192.168.1.156)  3004.149 ms !H * *
 2  * * *
 3  * * *
 4  192.168.1.156 (192.168.1.156)  3001.725 ms !H  3000.108 ms !H *

[houska]

predpokladam ze ip adresa toho dreamboxu je 192.168.1.156

[houska]

ten traceroute jsi utipnul ne?
zkus z toho ntb start/spustit/"cmd" a napis "tracert 213.29.7.27"

[houska]

co ten promiskuitni rezim? zkousel jsi to?

[rastislav]

traceroute z NTB - vypršal časový limit, dream je 156 a promiskuitní režim som skusil ale výsledok je ten isty, nejde to

[houska]

nepsal jsi nahodou

ISP mam vyhradené IP od 192.168.1.240-250

jestli ten dream ma 192.168.1.156 tak verim tomu ze z nej to ani jit nemuze

[rastislav]

jasne, ale ten dream je nazdieľaný a je povolená aj jeho IP kvoly sťahovaniu kľúčov z netu, ospravedlňujem sa :)

[houska]

tak jeste jinak
na tom PC s bridgem si pust tcpdump -i eth0, z toho windowsiho notebooku zkus znovu ping, melo by ti to vypisovat jak chodej icpm pakety, pak zkus to same jenze na rozhrani ath0, par radku vystupu dej sem

[rastislav]

eth :

14:27:47.795964 arp who-has 192.168.1.157 tell my.router
14:27:48.534553 IP 192.168.1.241.4106 > 0x57324414.hrnxx14.adsl-dhcp.tele.dk.11402: S 1181701924:1181701924(0) win 65535 mss 1460,nop,wscale 1,nop,nop,sackOK
14:27:48.635141 IP 192.168.1.241.4112 > pD955D890.dip.t-dialin.net.51207: S 983509689:983509689(0) win 65535 mss 1460,nop,wscale 1,nop,nop,sackOK
14:27:49.540568 IP 192.168.1.241.4107 > host149-217-dynamic.54-82-r.retail.telecomitalia.it.9104: S 2470417572:2470417572(0) win 65535 mss 1460,nop,wscale 1,nop,nop,sackOK

ath :

14:30:45.882105 IP 38.118.213.174.www > 192.168.1.240.41987: . 881158073:881159475(1402) ack 3979224676 win 6963
14:30:45.894528 IP 192.168.1.240.33056 > ns.telecom.sk.domain: 45055+ PTR? 240.1.168.192.in-addr.arpa. (44)
14:30:45.903161 IP ns.telecom.sk.domain > 192.168.1.240.33056: 45055 NXDomain* 0/0/0 (48)
14:30:45.939814 IP 192.168.1.240.41987 > 38.118.213.174.www: . ack 1402 win 65535
14:30:46.130462 IP 38.118.213.174.www > 192.168.1.240.41987: . 1402:2804(1402) ack 1 win 6963
14:30:46.132889 IP 38.118.213.174.www > 192.168.1.240.41987: . 2804:4206(1402) ack 1 win 6963
14:30:46.137474 IP 192.168.1.240.41987 > 38.118.213.174.www: . ack 4206 win 65535

[houska]

to jsi mi poslal to co nechci :( tak jeste jednou a presneji

tcpdump -i br- icmp

a az to pustis tak zkus z toho notebooku pingat ven

[houska]

oprava "br0"

[rastislav]

s icmp to nejde, výpis bez icmp :

15:02:01.232693 IP ns.telecom.sk.domain > 192.168.1.240.33061: 12525 1/0/0 (103)
15:02:01.244045 IP 192.168.1.240.33061 > ns.telecom.sk.domain: 22633+ PTR? 54.112.150.89.in-addr.arpa. (44)
15:02:01.357278 IP 192.168.1.241 > 192.168.1.240: ICMP echo request, id 512, seq 38400, length 40
15:02:01.357328 IP 192.168.1.240 > 192.168.1.241: ICMP echo reply, id 512, seq 38400, length 40
15:02:01.475794 arp who-has 192.168.1.241 tell 192.168.1.240
15:02:01.476764 arp reply 192.168.1.241 is-at 00:13:d4:ce:b7:b3 (oui Unknown)
15:02:01.502037 IP 192.168.1.241.1364 > cpc2-nott3-0-0-cust708.nott.cable.ntl.com.21865: S 1430570494:1430570494(0) win 65535 mss 1460,nop,wscale 1,nop,nop,sackOK
15:02:01.997165 IP ns.telecom.sk.domain > 192.168.1.240.33061: 22633 NXDomain 0/1/0 (99)
15:02:02.212868 IP 192.168.1.241 > 192.168.1.240: ICMP echo request, id 512, seq 38656, length 40
15:02:02.212916 IP 192.168.1.240 > 192.168.1.241: ICMP echo reply, id 512, seq 38656, length 40
15:02:02.531499 IP 192.168.1.241.1365 > 89-178-132-215.broadband.corbina.ru.3844: S 1971269089:1971269089(0) win 65535 mss 1460,nop,wscale 1,nop,nop,sackOK