[RESOLVED] Second NIC

[jeajea]

I followed the instructions for setting up the admin table, the two routes and the two rules and ping still didn’t work. I tried a reboot and learned the hard way that the routes and rules don’t survive a reboot.

Now I am more confused than ever.

I do not want the Dockstar to route between the subnets. I use my Zywall 5 for routing and firewalls. However, it appears that iproute2 interacts with iptables. I don’t know if iptables forwarding should be on or off in my case. I also don’t know how iptables should be configured when you aren’t forwarding. Currently all I have done is set forwarding to a 1. My 192.168.1.0 does have a real functional gateway which I put into the route. However, I never want to send anything to this gateway so I don’t understand what iproute2 uses the gateway for.

I would think that setting a Linux box to be visible on two or more subnets without forwarding should be a well documented procedure.

For Windows XP or VISTA (or 2000) there are three steps that must be done before you connect physically connect the second NIC to the second subnet.
1 leave one of the cards default gateway empty and DNS servers empty
2 set MaintainServerList to No in the registry
3 stop the computer browser service and set its startup to manual

For Windows 7 leaving the default gateway empty causes the Windows 7 firewall to configure the subnet as public. This makes no sense to me as public networks usually have a gateway. The workaround for this is to install Zone Alarm free and tell it to trust the subnet. This works because Zone Alarm disables and replaces the Windows firewall.

[WarheadsSE]

At least in terms of windows 7, that is because it assumes a no-gateway connection to be an ad-hoc network, and sets privacy accordingly. Overriding this is *easy*.

[pepedog]

You don't need forwarding in your case.
I will try this tommorow, tried today and I thought it worked.
Before, could ping google via eth1, couldn't ping windows machine on eth0
After, could ping windows machine
Try swapping eth0 and eth1 (cables AND config)

[jeajea]

@WarheadsSE
Would you mind sharing the "easy" override?

[WarheadsSE]

Google is your friend : http://windows.microsoft.com/en-US/wind ... k-location

[pepedog]

Looks like it is working, I will copy some stuff that might help (windows is .249, linux .239)
$this->bbcode_second_pass_code('', 'echo "1 admin" >> /etc/iproute2/rt_tables #you only ever do this once, it's saved
ip rule add from 192.168.2.0/24 table admin
ip rule add to 192.168.2.0/24 table admin
ip rule
0: from all lookup local
32764: from all to 192.168.2.0/24 lookup admin
32765: from 192.168.2.0/24 lookup admin
32766: from all lookup main
32767: from all lookup default

netstat -anr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
87.194.120.0 0.0.0.0 255.255.248.0 U 0 0 0 eth1
0.0.0.0 87.194.120.1 0.0.0.0 UG 0 0 0 eth1

C:\Users\dave>ping 192.168.2.249
Pinging 192.168.2.249 with 32 bytes of data:
Reply from 192.168.2.249: bytes=32 time<1ms TTL=128
Reply from 192.168.2.249: bytes=32 time<1ms TTL=128
Reply from 192.168.2.249: bytes=32 time<1ms TTL=128
Reply from 192.168.2.249: bytes=32 time<1ms TTL=128
Ping statistics for 192.168.2.249:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

ping 192.168.2.249
PING 192.168.2.249 (192.168.2.249) 56(84) bytes of data.
64 bytes from 192.168.2.249: icmp_req=1 ttl=128 time=0.741 ms
64 bytes from 192.168.2.249: icmp_req=2 ttl=128 time=0.242 ms
64 bytes from 192.168.2.249: icmp_req=3 ttl=128 time=0.220 ms
64 bytes from 192.168.2.249: icmp_req=4 ttl=128 time=0.235 ms
64 bytes from 192.168.2.249: icmp_req=5 ttl=128 time=0.235 ms
64 bytes from 192.168.2.249: icmp_req=6 ttl=128 time=0.265 ms

iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
eth0_in all -- anywhere anywhere
eth1_in all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:INPUT:DROP:'
DROP all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:sip
ACCEPT udp -- anywhere anywhere udp dpt:iax
ACCEPT tcp -- anywhere anywhere tcp dpt:sip

Chain FORWARD (policy DROP)
target prot opt source destination
eth0_fwd all -- anywhere anywhere
eth1_fwd all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:FORWARD:DROP:'
DROP all -- anywhere anywhere

Chain OUTPUT (policy DROP)
target prot opt source destination
eth0_out all -- anywhere anywhere
eth1_out all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:OUTPUT:DROP:'
DROP all -- anywhere anywhere

Chain Drop (11 references)
target prot opt source destination
reject tcp -- anywhere anywhere tcp dpt:ident
dropBcast all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
dropInvalid all -- anywhere anywhere
DROP udp -- anywhere anywhere multiport dports epmap,microsoft-ds
DROP udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
DROP udp -- anywhere anywhere udp spt:netbios-ns dpts:1024:65535
DROP tcp -- anywhere anywhere multiport dports epmap,netbios-ssn,microsoft-ds
DROP udp -- anywhere anywhere udp dpt:ssdp
dropNotSyn tcp -- anywhere anywhere
DROP udp -- anywhere anywhere udp spt:domain

Chain Reject (0 references)
target prot opt source destination
reject tcp -- anywhere anywhere tcp dpt:ident
dropBcast all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
dropInvalid all -- anywhere anywhere
reject udp -- anywhere anywhere multiport dports epmap,microsoft-ds
reject udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
reject udp -- anywhere anywhere udp spt:netbios-ns dpts:1024:65535
reject tcp -- anywhere anywhere multiport dports epmap,netbios-ssn,microsoft-ds
DROP udp -- anywhere anywhere udp dpt:ssdp
dropNotSyn tcp -- anywhere anywhere
DROP udp -- anywhere anywhere udp spt:domain

Chain all2fw (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:all2fw:DROP:'
DROP all -- anywhere anywhere

Chain all2loc (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:all2loc:DROP:'
DROP all -- anywhere anywhere

Chain all2net (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:all2net:DROP:'
DROP all -- anywhere anywhere

Chain blacklst (2 references)
target prot opt source destination
DROP all -- 61.149.0.0/16 anywhere
DROP all -- 69.197.84.0/24 anywhere
DROP all -- 24.114.240.0/24 anywhere
DROP all -- 24.114.247.0/24 anywhere
DROP all -- 82.130.128.0/24 anywhere
DROP all -- 82.130.129.0/24 anywhere
DROP all -- 82.130.131.0/24 anywhere
DROP all -- 82.130.132.0/24 anywhere


Chain dropBcast (2 references)
target prot opt source destination
DROP all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
DROP all -- anywhere BASE-ADDRESS.MCAST.NET/4

Chain dropInvalid (2 references)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID

Chain dropNotSyn (2 references)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN

Chain dynamic (4 references)
target prot opt source destination

Chain eth0_fwd (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state INVALID,NEW
blacklst all -- anywhere anywhere state INVALID,NEW
net2loc all -- anywhere anywhere

Chain eth0_in (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state INVALID,NEW
blacklst all -- anywhere anywhere state INVALID,NEW
net2fw all -- anywhere anywhere

Chain eth0_out (1 references)
target prot opt source destination
fw2net all -- anywhere anywhere

Chain eth1_fwd (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state INVALID,NEW
loc2net all -- anywhere anywhere

Chain eth1_in (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere state INVALID,NEW
loc2fw all -- anywhere anywhere

Chain eth1_out (1 references)
target prot opt source destination
fw2loc all -- anywhere anywhere

Chain firewall (0 references)
target prot opt source destination

Chain fw2all (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:fw2all:DROP:'
DROP all -- anywhere anywhere

Chain fw2loc (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere

Chain fw2net (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp dpt:ipp
DROP udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere

Chain loc2all (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:loc2all:DROP:'
DROP all -- anywhere anywhere

Chain loc2fw (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere

Chain loc2net (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere

Chain logdrop (0 references)
target prot opt source destination
DROP all -- anywhere anywhere

Chain logreject (0 references)
target prot opt source destination
reject all -- anywhere anywhere

Chain net2all (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:net2all:DROP:'
DROP all -- anywhere anywhere

Chain net2fw (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere multiport dports http,https,ftp-data,ftp,smtp,pop2,pop3,auth,imap,nntp,ldap,49152,49153,49154,49155
ACCEPT tcp -- anywhere anywhere multiport dports http,https,ftp-data,ftp,smtp,pop2,pop3,imap,ident,nntp,ldap,49152,49153,49154,49155
DROP tcp -- anywhere anywhere tcp dpt:24448
DROP udp -- anywhere anywhere udp dpt:24448
ACCEPT udp -- anywhere anywhere multiport dports http,https,ftp-data,ftp,smtp,pop2,pop3,auth,imap,nntp,ldap,49152,49153,49154,49155
ACCEPT tcp -- anywhere anywhere multiport dports http,https,ftp-data,ftp,smtp,pop2,pop3,ident,imap,nntp,ldap,49152,49153,49154,49155
ACCEPT tcp -- ttigers.co.uk anywhere tcp dpts:tcpmux:64000
ACCEPT udp -- ttigers.co.uk anywhere udp dpts:tcpmux:64000
ACCEPT tcp -- myplugbox.com anywhere tcp dpts:tcpmux:64000
ACCEPT udp -- myplugbox.com anywhere udp dpts:tcpmux:64000
ACCEPT tcp -- dogagent.com anywhere tcp dpts:tcpmux:64000
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:net2fw:DROP:'
DROP all -- anywhere anywhere

Chain net2loc (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp dpt:24448
DROP udp -- anywhere anywhere udp dpt:24448
ACCEPT tcp -- anywhere 192.168.2.245 tcp dpt:qsm-gui ctorigdst myplugbox.com
ACCEPT tcp -- anywhere 192.168.2.244 tcp dpt:30519 ctorigdst myplugbox.com
ACCEPT tcp -- anywhere 192.168.2.230 tcp dpt:5113 ctorigdst myplugbox.com
ACCEPT udp -- anywhere 192.168.2.230 udp dpt:5113 ctorigdst myplugbox.com
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level info prefix `Firewall:net2loc:DROP:'
DROP all -- anywhere anywhere

Chain reject (7 references)
target prot opt source destination
DROP all -- anywhere anywhere ADDRTYPE match src-type BROADCAST
DROP all -- BASE-ADDRESS.MCAST.NET/4 anywhere
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
REJECT icmp -- anywhere anywhere reject-with icmp-host-unreachable
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain smurfs (0 references)
target prot opt source destination
RETURN all -- 0.0.0.0 anywhere
LOG all -- anywhere anywhere ADDRTYPE match src-type BROADCAST LOG level info prefix `Firewall:smurfs:DROP:'
DROP all -- anywhere anywhere ADDRTYPE match src-type BROADCAST
LOG all -- BASE-ADDRESS.MCAST.NET/4 anywhere LOG level info prefix `Firewall:smurfs:DROP:'
DROP all -- BASE-ADDRESS.MCAST.NET/4 anywhere


')

[jeajea]

Thanks for all the help.
My adapter is defective. ifconfig -a shows the interface up and that it is sending and receiving data which lead me to believe it is working but it isn’t. It also doesn't work on a Windows Vista PC.

I replaced it with no name 100 megabit labeled KY-RS9600 and everything works. Before I replaced the adapter my USB drive got corrupted so I did a clean install of plug box Linux without iptables or iproute2. So in my case of two local subnets you don’t need iptables and you don’t need iproute2.

lsusb
$this->bbcode_second_pass_code('', '
[root@DS101 ~]# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc. USB-2.0 4-Port HUB
Bus 001 Device 003: ID 0000:0000
Bus 001 Device 004: ID 0fe6:8101 Kontron (Industrial Computer Source / ICS Advent) DM9601 Fast Ethernet Adapter
')

rc.conf
$this->bbcode_second_pass_code('', '
#
# /etc/rc.conf - Arch Linux ARM install Linux Main Configuration
#

# -----------------------------------------------------------------------
# LOCALIZATION
# -----------------------------------------------------------------------
#
LOCALE="en_US.UTF-8"
HARDWARECLOCK="localtime"
TIMEZONE="America/New_York"
KEYMAP="us"
CONSOLEFONT=
CONSOLEMAP=
USECOLOR="yes"

# -----------------------------------------------------------------------
# HARDWARE
# -----------------------------------------------------------------------
#
# MOD_AUTOLOAD: Allow autoloading of modules at boot and when needed
# MOD_BLACKLIST: Prevent udev from loading these modules
# MODULES: Modules to load at boot-up. Prefix with a ! to blacklist.
#
# NOTE: Use of 'MOD_BLACKLIST' is deprecated. Please use ! in the MODULES array.
#
MOD_AUTOLOAD="yes"
#MOD_BLACKLIST=() #deprecated
MODULES=()

# Scan for LVM volume groups at startup, required if you use LVM
USELVM="no"

# -----------------------------------------------------------------------
# NETWORKING
# -----------------------------------------------------------------------
#
# HOSTNAME: Hostname of machine. Should also be put in /etc/hosts
#
HOSTNAME="DS101"

# Use 'ifconfig -a' or 'ls /sys/class/net/' to see all available interfaces.
#
# Interfaces to start at boot-up (in this order)
# Declare each interface then list in INTERFACES
# - prefix an entry in INTERFACES with a ! to disable it
# - no hyphens in your interface names - Bash doesn't like it
#
# DHCP: Set your interface to "dhcp" (eth0="dhcp")
# Wireless: See network profiles below
#

#Static IP example
eth0="eth0 172.24.80.178 netmask 255.255.255.224 broadcast 172.24.80.191"
eth1="eth1 192.168.1.213 netmask 255.255.255.0 broadcast 192.168.1.255"
#eth0="dhcp"
INTERFACES=(eth0 eth1)

# Routes to start at boot-up (in this order)
# Declare each route then list in ROUTES
# - prefix an entry in ROUTES with a ! to disable it
#
gateway="default gw 172.24.80.161"
ROUTES=(gateway)

# Setting this to "yes" will skip network shutdown.
# This is required if your root device is on NFS.
NETWORK_PERSIST="no"

# Enable these network profiles at boot-up. These are only useful
# if you happen to need multiple network configurations (ie, laptop users)
# - set to 'menu' to present a menu during boot-up (dialog package required)
# - prefix an entry with a ! to disable it
#
# Network profiles are found in /etc/network.d
#
# This now requires the netcfg package
#
#NETWORKS=(main)

# -----------------------------------------------------------------------
# DAEMONS
# -----------------------------------------------------------------------
#
# Daemons to start at boot-up (in this order)
# - prefix a daemon with a ! to disable it
# - prefix a daemon with a @ to start it up in the background
#
DAEMONS=(syslog-ng network openntpd netfs crond sshd samba)
[root@DS101 etc]#

')

Ping
$this->bbcode_second_pass_code('', '
[root@DS101 ~]# ping 172.24.80.169
PING 172.24.80.169 (172.24.80.169) 56(84) bytes of data.
64 bytes from 172.24.80.169: icmp_req=1 ttl=128 time=1.93 ms
64 bytes from 172.24.80.169: icmp_req=2 ttl=128 time=1.81 ms
64 bytes from 172.24.80.169: icmp_req=3 ttl=128 time=2.02 ms
^C
--- 172.24.80.169 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.814/1.924/2.026/0.086 ms
[root@DS101 ~]# ping 192.168.1.204
PING 192.168.1.204 (192.168.1.204) 56(84) bytes of data.
64 bytes from 192.168.1.204: icmp_req=1 ttl=128 time=6.26 ms
64 bytes from 192.168.1.204: icmp_req=2 ttl=128 time=0.632 ms
64 bytes from 192.168.1.204: icmp_req=3 ttl=128 time=0.509 ms
^
')

$this->bbcode_second_pass_code('', '

[root@DS101 ~]# ifconfig -a
eth0 Link encap:Ethernet HWaddr 02:50:43:72:75:BE
inet addr:172.24.80.178 Bcast:172.24.80.191 Mask:255.255.255.224
inet6 addr: fe80::50:43ff:fe72:75be/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:188 errors:0 dropped:0 overruns:0 frame:0
TX packets:164 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:17878 (17.4 Kb) TX bytes:17164 (16.7 Kb)
Interrupt:11

eth1 Link encap:Ethernet HWaddr 00:10:14:01:5B:60
inet addr:192.168.1.213 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::210:14ff:fe01:5b60/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:424 (424.0 b) TX bytes:3573 (3.4 Kb)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:178 (178.0 b) TX bytes:178 (178.0 b)

[')

[WarheadsSE]

Awesome.

As always it sucks that the adapter was the problem causing ALL of this headache, but great to hear that it really is that simple.

Can you edit your first post's subject to have [RESOLVED] in front of it?

[jeajea]

My adapter now works in Widows with no problems. I had a Windows configuration problem with my two subnets.
Based on the readme file I attached to this post I believe what I need is a newer version of the ASIX module.

viewtopic.php?f=15&t=1165

Different venders use different PHY chips with the ASIX AX88178 USB network chip. With the current driver my adapter doesn’t actually transmit anything out over Ethernet. The driver in Debian 5.06 that I am using on a PC has the same problem with this adapter.

[jeajea]

I now have the Monoprice USB gigabit working

http://www.monoprice.com/products/produ ... 1&format=2

The new version fixes my problem.
Because it is a module I didn’t have to build a new kernel.
I had to install the basic native compiling tools

http://Arch Linux ARM.com/index.php5/Develope ... g_Packages

I did have to download and unpack the kernel source.
I had to use gzip to compress asix.ko to asix.ko.gz
I saved the old version and copied the new version to

/lib/modules/2.6.38/kernel/drivers/net/usb/

I had to add asix to the modules line in rc.conf

I don’t know how to contact the maintainer of the code within the mainline kernel.