can't figure out problem with iptables

You need to define a route (NAT) from eth1 through eth0

What is the default gateway that is set on the 192.168.0.0 computers?
Does it match the IP of the eth1 interface?

in /etc/sysctl.conf
Do you have forwarding enabled?
net.ipv4.ip_forward = 1

There are several references on setting up linux as a router.
http://etutorials.org/Linux+systems/red+hat+linux+bible+fedora+enterprise+edition/Part+IV+Red+Hat+Linux+Network+and+Server+Setup/Chapter+16+Connecting+to+the+Internet/Setting+up+Red+Hat+Linux+as+a+Router/

You are on a slackware system, but the iptables rules/configuration should still apply.

You dont seem to nat the traffic from that address nor you have a single interface in that network.
Can you post output of "iprables-save" ?

Arnold:

You need to define a route (NAT) from eth1 through eth0

Is than not what I have in lines 33,34 of my first source listing in initial post?

    /usr/sbin/iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
    /usr/sbin/iptables --append FORWARD --in-interface eth1 -j ACCEPT

What is the default gateway that is set on the 192.168.0.0 computers? Does it match the IP of the eth1 interface?

Yes, they are set to DHCP and the gateway is this host at 192.168.0.2. For example:

C:\Users\mark.HPRS>ipconfig
Windows IP Configuration

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : hprs.local
   Link-local IPv6 Address . . . . . : fe80::286e:664d:27b7:eb1b%13
   IPv4 Address. . . . . . . . . . . : 192.168.0.58
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.2

Tunnel adapter isatap.hprs.local:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : hprs.local

Tunnel adapter Local Area Connection* 12:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected

Select allOpen in new window

in /etc/sysctl.conf
 Do you have forwarding enabled?
 net.ipv4.ip_forward = 1

Yes:

$ cat /proc/sys/net/ipv4/ip_forward
1

Select allOpen in new window

There are several references on setting up linux as a router.

The routing isn't the problem I've set up several Linux hosts as routers. I can route just fine using only the NAT rules. My problem are the drop rules. I'm doing something to prevent LAN hosts from using this computer for DNS. They can't resolve each other and they can't resolve external domains.

gheist:

You dont seem to nat the traffic from that address

yes, see lines 33,34 in my initial src posting.

nor you have a single interface in that network.

Don't know what you mean by that. Please clarify.

Can you post output of "iprables-save" ?

yes, but will have to be tomorrow when I'm in front of the console so I can fix when I mess up the LAN.

Can you ping https://www.experts-exchange.com from the LAN?

Just looking to confirm whether your input policy line 6 coming via eth1 limits Lan to tcp traffic only.

Sorry for the delay ... lots of gnats to swat on this one.

gheist:

Can you post output of "iprables-save" ?

Here it is:

# Generated by iptables-save v1.4.20 on Sun Feb 22 19:51:57 2015
*raw
:PREROUTING ACCEPT [114:10002]
:OUTPUT ACCEPT [66:6316]
COMMIT
# Completed on Sun Feb 22 19:51:57 2015
# Generated by iptables-save v1.4.20 on Sun Feb 22 19:51:57 2015
*mangle
:PREROUTING ACCEPT [114:10002]
:INPUT ACCEPT [110:9828]
:FORWARD ACCEPT [4:174]
:OUTPUT ACCEPT [66:6316]
:POSTROUTING ACCEPT [70:6490]
COMMIT
# Completed on Sun Feb 22 19:51:57 2015
# Generated by iptables-save v1.4.20 on Sun Feb 22 19:51:57 2015
*nat
:PREROUTING ACCEPT [15:1500]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:328]
:POSTROUTING ACCEPT [1:328]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1901 -j DNAT --to-destination 192.168.0.100:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1903 -j DNAT --to-destination 192.168.0.4:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1904 -j DNAT --to-destination 192.168.0.50:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1905 -j DNAT --to-destination 192.168.0.51:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1906 -j DNAT --to-destination 192.168.0.52:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1907 -j DNAT --to-destination 192.168.0.53:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1908 -j DNAT --to-destination 192.168.0.54:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1909 -j DNAT --to-destination 192.168.0.55:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1910 -j DNAT --to-destination 192.168.0.56:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1911 -j DNAT --to-destination 192.168.0.57:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1912 -j DNAT --to-destination 192.168.0.58:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1913 -j DNAT --to-destination 192.168.0.59:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1902 -j DNAT --to-destination 192.168.0.101:3389
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sun Feb 22 19:51:57 2015
# Generated by iptables-save v1.4.20 on Sun Feb 22 19:51:57 2015
*filter
:INPUT DROP [19:2812]
:FORWARD ACCEPT [2:85]
:OUTPUT ACCEPT [66:6316]
:checkcount - [0:0]
:logdrop - [0:0]
-A INPUT -s 76.181.64.0/23 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 96.11.168.98/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i -eth0 -p tcp -m multiport --dports 1901:1902
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j checkcount
-A INPUT -i eth0 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec --limit-burst 3 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 25,80,443 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A checkcount -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
-A checkcount -m recent --rcheck --hitcount 12 --name DEFAULT --mask 255.255.255.255 --rsource -j logdrop
-A checkcount -j RETURN
-A logdrop -j LOG --log-prefix "SSH Break-in attempt " --log-level 6
-A logdrop -j DROP
COMMIT
# Completed on Sun Feb 22 19:51:57 2015

Select allOpen in new window

Arnold:

What is the ip on the eth1 interface?

192.168.0.2

Can you post the routing table from the linux box?

Will do so after work hours when I put the firewall back without messing up staff.

you are not allowing udp from the LAN implicit deny by policy.

Ah ah! This may very well be the problem! I will try that this evening.

try this before going from the lan browse to http://54.209.131.74 EE web server.
This will confirm whether the issue is the failure to lookup the address versus inability to get through to the internet.

Arnold:

you are not allowing udp from the LAN implicit deny by policy.

I added: iptables -A INPUT -i eth1 -p udp -j ACCEPT

and that does seem to have fixed it! I wasn't thinking about DNS being udp. I'll continue watching this to make sure.

Can you post the routing table from the linux box?

Here it is:

$ route -vv
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         <REDACTED>    0.0.0.0         UG    1      0        0 eth0
64.129.23.0     *               255.255.255.0   U     0      0        0 eth0
loopback        *               255.0.0.0       U     0      0        0 lo
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1

Select allOpen in new window

try this before going from the lan browse to http://54.209.131.74 EE web server.
 This will confirm whether the issue is the failure to lookup the address versus inability to get through to the internet.

Hmmm, not sure what this is telling me. When going to that IP from a client workstation I got (from EE):

An unexpected error occured during your request.
For immediate assistance please contact Customer Service.
Details: (Type: com.ee.common.exception.ExpectedException)
Caused By: (Type: com.ee.common.exception.CMSSiteNotDefinedException)

But I can browse to google and other external webpages.

What do you think?

Hi mark,

Should have checked before posting the IP as a test, the site is named based seems to not like access by ip.  

Glad to hear the addition of the udp rule solved the issue.  
Icmp is the only one currently missing from being allowed from the LAN to the outside.

Arnold:

Redacted the IP referenced as the gateway

Thanks.

Icmp is the only one currently missing from being allowed from the LAN to the outside.

From LAN to outside should be all permitted with rule:

/usr/sbin/iptables -P OUTPUT ACCEPT

Right? I can ping anyone inside or outside the LAN:

$ ping yahoo.com
PING yahoo.com (206.190.36.45) 56(84) bytes of data.
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=1 ttl=50 time=73.0 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=2 ttl=50 time=75.1 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=3 ttl=50 time=71.2 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=4 ttl=50 time=74.9 ms

Select allOpen in new window

Things seem to be working just fine. Apparently my problem was not permitting DNS on udp. If more issues crop up I'll post another question.

I managed to load your iptables-save into fwbuilder.
What does sysctl net.ipv4.ip_forward
say? Must be 1 for *ROUTING tables to work.

gheist:

What does sysctl net.ipv4.ip_forward
 say? Must be 1 for *ROUTING tables to work.

Yes, it is set to 1.

The problem was that I didn't enable DNS for udp. Once I did that, problem solved. I forgot that DNS uses udp on port 53.

ntp uses udp on port 123

Thanks! I think I might need that too.