From: "Jean-Francois Bélanger" jef@tech-info.qc.ca

Just use :

/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j SNAT --to-source [net_ip_adr]

Work fine whit this.

Jean-Francois

On Fri, 2003-08-08 at 10:21, Greg Sanders wrote:

...

I just upgraded from a pre 8 beta to the current beta and it looks like masquerading is borked...

[root@lanfest1 root]# iptables -t nat -A POSTROUTING -s

192.168.0.0/16 -o

...

ppp0 -j MASQUERADE iptables: No chain/target/match by that name

...

...

[root@lanfest1 root]# modprobe ipt_MASQUERADE

/lib/modules/2.4.21-20.1.2024.2.1.nptl/kernel/net/ipv4/netfilter/ipchains.o:

...

init_module: Device or resource busy

^^^^^^^^^^

This is another place Greg screwed up. You cannot mix ipchains and iptables. ipt_MASQUERADE is apparently a part of the (pathetic) ipchains emulation under iptables.

"rpm -e ipchains" is always a worthwhile exercise on modern stups. Then ONLY the valid iptables modules are left.

Here is an extract from my iptables script with comments. It is generic and current as of 7.2 so there may be some slight changes since then for newer Red Hat systems.

---8<---

echo -en " Loading kernel modules: "

# With the new IPTABLES code, the core MASQ functionality is now either # modular or compiled into the kernel. This HOWTO shows ALL IPTABLES # options as MODULES. If your kernel is compiled correctly, there is # NO need to load the kernel modules manually. # # NOTE: The following items are listed ONLY for informational reasons. # There is no reason to manual load these modules unless your # kernel is either mis-configured or you intentionally disabled # the kernel module autoloader. #

# Upon the commands of starting up IP Masq on the server, the # following kernel modules will be automatically loaded: # # NOTE: Only load the IP MASQ modules you need. All current IP MASQ # modules are shown below but are commented out from loading. # ===============================================================

#Load the main body of the IPTABLES module - "ip_tables" # - Loaded automatically when the "iptables" command is invoked # # - Loaded manually to clean up kernel auto-loading timing issues # echo -en "ip_tables, " # #Verify the module isn't loaded. If it is, skip it # if [ -z "` $LSMOD | $GREP ip_tables | $AWK {'print $1'} `" ]; then $INSMOD ip_tables fi

#Load the IPTABLES filtering module - "iptable_filter" # # - Loaded automatically when filter policies are activated

#Load the stateful connection tracking framework - "ip_conntrack" # # The conntrack module in itself does nothing without other specific # conntrack modules being loaded afterwards such as the "ip_conntrack_ftp" # module # # - This module is loaded automatically when MASQ functionality is # enabled # # - Loaded manually to clean up kernel auto-loading timing issues # echo -en "iptable_nat, " # #Verify the module isn't loaded. If it is, skip it # if [ -z "` $LSMOD | $GREP iptable_nat | $AWK {'print $1'} `" ]; then $INSMOD iptable_nat fi

#Loads the FTP NAT functionality into the core IPTABLES code # Required to support non-PASV FTP. # # Enabled by default -- insert a "#" on the next line to deactivate # echo -e "ip_nat_ftp" # #Verify the module isn't loaded. If it is, skip it # if [ -z "` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} `" ]; then $INSMOD ip_nat_ftp fi

echo " ---"

# Just to be complete, here is a list of the remaining kernel modules # and their function. Please note that several modules should be only # loaded by the correct master kernel module for proper operation. # -------------------------------------------------------------------- # # ipt_mark - this target marks a given packet for future action. # This automatically loads the ipt_MARK module # # ipt_tcpmss - this target allows to manipulate the TCP MSS # option for braindead remote firewalls. # This automatically loads the ipt_TCPMSS module # # ipt_limit - this target allows for packets to be limited to # to many hits per sec/min/hr # # ipt_multiport - this match allows for targets within a range # of port numbers vs. listing each port individually # # ipt_state - this match allows to catch packets with various # IP and TCP flags set/unset # # ipt_unclean - this match allows to catch packets that have invalid # IP/TCP flags set # # iptable_filter - this module allows for packets to be DROPped, # REJECTed, or LOGged. This module automatically # loads the following modules: # # ipt_LOG - this target allows for packets to be # logged # # ipt_REJECT - this target DROPs the packet and returns # a configurable ICMP packet back to the # sender. # # iptable_mangle - this target allows for packets to be manipulated # for things like the TCPMSS option, etc.

#CRITICAL: Enable IP forwarding since it is disabled by default since # # Redhat Users: you may try changing the options in # /etc/sysconfig/network from: # # FORWARD_IPV4=false # to # FORWARD_IPV4=true # echo " Enabling forwarding.." echo "1" > /proc/sys/net/ipv4/ip_forward

---8<---

{^_^}

From: "Greg Sanders" greg@elcoronel.com

On Fri, 8 Aug 2003, jdow wrote:

...

This is another place Greg screwed up. You cannot mix ipchains and iptables. ipt_MASQUERADE is apparently a part of the (pathetic) ipchains emulation under iptables.

"rpm -e ipchains" is always a worthwhile exercise on modern stups. Then ONLY the valid iptables modules are left.

Actually, I didn't screw this up...

[root@lanfest1 usr]# rpm -e ipchains error: package ipchains is not installed

The problem is with the default module build shipping with the beta. And since I don't have the source rpms (dialup here), I'm not in a position to rebuild them.

Greg, I thought that was you trying to install ipt_MASQUERADE. Unless it changed with the most recent kernels that is not one of the modules involved. Of course, your "screwup" might have been entirely excusable if it was an automated firewall setup tool that tried to add that module. And given how tenaciously Red Hat hung on with ipchains I'd not want to bet that even at this date the last vistages of ipchains are gone.

{^_-}

Trying to run up2date and getting the following error:

The package GConf2-2.3.3-2 is not signed with a GPG signature. Aborting... Package GConf2-2.3.3-2 does not have a GPG signature. Aborting...

I didn't see anything like this in the archive. Did I miss something?

Greg Sanders - Sysadmin, Webhead, Tolkien-phile ElCoronel @ irc.freenode.net - http://elcoronel.com/ ------------------------------------------------------------------------- Wherein [art thou] good, but to taste sack and drink it? Wherein neat and cleanly, but to carve a capon and eat it? Wherein cunning, but in craft? Wherein crafty but in villainy? Wherein villainous, but in all things? Wherein worthy but in nothing? -William Shakespeare, Henry IV, part I

Yes, I'm getting that with every package on the severn updates channel (including the one you mention). It's normal with Rawhide: https://listman.redhat.com/archives/rhl-beta-list/2003-August/msg00613.html

Martin

On Mon, 2003-09-01 at 02:37, Steven Haigh wrote:

Yeah - I get this as well... I've always just run up2date <args> --nosig

Since the matter has been brought up, is this a known problem? something I've forgotten? part of the beta experiance?

Greg Sanders wrote:

...

Trying to run up2date and getting the following error:

The package GConf2-2.3.3-2 is not signed with a GPG signature. Aborting... Package GConf2-2.3.3-2 does not have a GPG signature. Aborting...

I didn't see anything like this in the archive. Did I miss something?

Greg Sanders - Sysadmin, Webhead, Tolkien-phile ElCoronel @ irc.freenode.net - http://elcoronel.com/

Elliot Lee wrote:

On 1 Sep 2003, nosp wrote:

...

Yes, I'm getting that with every package on the severn updates channel (including the one you mention). It's normal with Rawhide: https://listman.redhat.com/archives/rhl-beta-list/2003-August/msg00613.html

It's _not_ normal with RHN however.

You need to import the new rawhide key into your rpm database. Get http://www.redhat.com/security/e418e3aa.txt and run 'rpm --import' on the downloaded file.

-- Elliot For peace of mind, resign as general manager of the universe.

-- Rhl-beta-list mailing list Rhl-beta-list@redhat.com http://www.redhat.com/mailman/listinfo/rhl-beta-list

Awesome. Redhat delivers again.... As I stated in an earlier post, it's been quite some time since I've had linux as my main desktop OS... From running Severn for about a month now, there is only a few small issues I have encoutered (listed below) however, on the whole, everything has been pretty straight forward... I can IRC, surf, email, news, IM, mp3 play, rip&encode, burn CD's, access Word/Excel documents mostly without any problems what so ever... Excellent work. :)

The problems however are as such - ranked in order of annoyance. 1) On an IMAP email account, Ctrl+Shift+C doesn't mark all threads as read in Mozilla Mail - even though that shortcut is stated in the menu (Messages -> Mark -> All as read) It's easy enough to work around, just darn annoying.

2) Print quality on a Canon S400 using the gimp-print driver looks like it's in draft mode when printing from OpenOffice. I've friggd around with the driver settings, but haven't been able to get acceptable quality... Even the JPG printer test in X's printconf looks like a dotty draft mode. Solution at the moment is to reboot into XP with Office XP to print documents. Annoying, but I don't require this *that* often.

3) Noatun and Kaboodle haven't been able to play squat in MPG files or half of the other filetypes associated with it... Not a great concern because XMMS whoops over noatun/kaboodle :P