when i played with my dick
,
i changed configuration on assus,
I removed WDS, set standard AP mode and a ovislink 5460 is connected as a client (address *.2.98),
settings:
assus: AP (only)
lan_ifname=eth0
lan_ifnames=eth0
lan_ipaddr=192.168.3.99
lan_netmask=255.255.255.0
lan_gateway=192.168.2.1
lan_proto=static
wifi_ifname=eth2
wifi_ifnames=eth2
wifi_ipaddr=192.168.2.99
wifi_netmask=255.255.255.0
wifi_gateway=192.168.2.1
wifi_proto=static
S40network:
ifup lan
ifup wifi
S45firewall:
#!/bin/sh
## Please make changes in /etc/firewall.user
${FAILSAFE:+exit}
. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
#LAN2=$(nvram get lan2_ifname)
WIFI=$(nvram get wifi_ifname)
## CLEAR TABLES
for T in filter nat; do
iptables -t $T -F
iptables -t $T -X
done
#- iptables -N input_rule
#- iptables -N output_rule
#- iptables -N forwarding_rule
iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule
### INPUT
### (connections with the router as destination)
# base case
iptables -P INPUT ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#- iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
#
# insert accept rule or to jump to new accept-check table here
#
#- iptables -A INPUT -j input_rule
# allow
iptables -A INPUT -i \! $WAN -j ACCEPT # allow from lan/wifi interfaces
iptables -A INPUT -p icmp -j ACCEPT # allow ICMP
iptables -A INPUT -p gre -j ACCEPT # allow GRE
# reject (what to do with anything not allowed earlier)
#- iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
#- iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
### OUTPUT
### (connections with the router as source)
# base case
iptables -P OUTPUT ACCEPT
#- iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#
# insert accept rule or to jump to new accept-check table here
#
#- iptables -A OUTPUT -j output_rule
# allow
iptables -A OUTPUT -j ACCEPT #allow everything out
# reject (what to do with anything not allowed earlier)
#- iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
#- iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
### FORWARDING
### (connections routed through the router)
# base case
iptables -P FORWARD ACCEPT
#iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#
# insert accept rule or to jump to new accept-check table here
#
#- iptables -A FORWARD -j forwarding_rule
# allow
iptables -A FORWARD -i br0 -o br0 -j ACCEPT
#iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
#iiptables -A FORWARD -i $LAN -o $LAN2 -j ACCEPT
#iptables -A FORWARD -i $LAN2 -o $LAN -j ACCEPT
#iptables -A FORWARD -i $LAN2 -o $LAN2 -j ACCEPT
iptables -A FORWARD -i $WIFI -o $LAN -j ACCEPT
#iptables -A FORWARD -i $WIFI -o $LAN2 -j ACCEPT
iptables -A FORWARD -o $WIFI -i $LAN -j ACCEPT
#iptables -A FORWARD -o $WIFI -i $LAN2 -j ACCEPT
# reject (what to do with anything not allowed earlier)
# uses the default -P DROP
### MASQ
iptables -t nat -A PREROUTING -j prerouting_rule
iptables -t nat -A POSTROUTING -j postrouting_rule
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
## USER RULES
# [ -f /etc/firewall.user ] && . /etc/firewall.user
root@OpenWrt:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:11:2F:E3:25:2D
inet addr:192.168.3.99 Bcast:192.168.3.255 Mask:255.255.255.0
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:884 errors:0 dropped:0 overruns:0 frame:0
TX packets:509 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:80383 (78.4 KiB) TX bytes:105549 (103.0 KiB)
Interrupt:3 Base address:0x2000
eth2 Link encap:Ethernet HWaddr 00:11:2F:E3:25:2D
inet addr:192.168.2.99 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2492 errors:0 dropped:0 overruns:0 frame:294
TX packets:2829 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:265340 (259.1 KiB) TX bytes:417728 (407.9 KiB)
Interrupt:6 Base address:0x2000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:549 errors:0 dropped:0 overruns:0 frame:0
TX packets:549 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:48312 (47.1 KiB) TX bytes:48312 (47.1 KiB)
root@OpenWrt:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 eth2
now I can ping to asus *.2.99 , but no routing via the asus works ,
works:
ping from *.2.30 to *.2.99 (*.3.99)
ping from *.3.34 to *.3.99 (*.2.99)
doesnt work:
ping from *.2.30 to *.3.34
ping from *.3.34 to *.2.30
One problem was probably in WDS, it's eliminated.
ie: I tried connect the asus as client, without success
too, it will be solved latter
Why?
(Last edited by reset on 5 Dec 2005, 08:13)