I run my Linux/jnos box in DMZ since day one..
Jerry Kutche Electrical Supervisor
Lehigh Cement Company LLC 180 N. Meridian Road Mitchell, IN 47446 Phone: (812) 849-2191 ext. 251 Fax: (812) 849-5007 Cell: (812) 583-0445 jkutche@lehighcement.com www.lehighcement.com This e-mail may contain confidential and/or legally privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and delete this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.
-----Original Message----- From: 44net-bounces+jkutche=lehighcement.com@hamradio.ucsd.edu [mailto:44net-bounces+jkutche=lehighcement.com@hamradio.ucsd.edu] On Behalf Of Demetre SV1UY Sent: Monday, August 05, 2013 12:12 PM To: AMPRNet working group Subject: Re: [44net] IP Protocol 4 in DD-WRT and rip44d script
(Please trim inclusions from previous messages) _______________________________________________ Hi Marcus,
Thanks for reply. I will follow your instructions when I return home tonight. Please let me know, is the DMZ thing necessary if I follow your instructions? I hope I don't have to use DMZ because it is a bit dodgy today! hi hi hi!!
73 de SV1UY
On Mon, Aug 5, 2013 at 6:40 PM, Marc, LX1DUC lx1duc@rlx.lu wrote:
Unless you are forwarding the decapsulated packets from your DD-WRT towards a host inside the NATted LAN, you don't need to bother about ports. Packets from the AMPRnet Mesh use IPIP protocol(protocol number 94), so the Layer 4 is not necessarily visible to DD-WRT as these packets fill contain 2x Layer 3.
You will need to forward IPIP protocol packets from the DD-WRT to your internal AMPRnet gateway.
On your AMPRnet gatway (not DD-WRT) you will eventually need to allow packets towards port 520/udp in your iptables if you are using iptables on your internal gateway.
Please also don't confuse opening a port and opening a port (yes! your wording is weak... H-I)
You should make a difference between allowing a packet to be forwarded (iptables table FORWARD) by a router and a packet to be received (iptables table INPUT) by a host.
In case you are combining DNAT and FORWARDing on 1 machine (you usually do), you may eventually need to apply
iptables -t NAT -A PREROUTING -p 94 -j DNAT --to 192.0.2.1 iptables -A FORWARD -p 94 -d 192.0.2.1 -j ACCEPT
in case you are not allowing packets to be forwarded by default or have configured a rule to disallow unknown traffic.
On the AMPRnet Gateway (not your DD-WRT) you will eventually need to allow IPIP inbound packets on eth0 and allow packets towards port 520/udp.
iptables -A INPUT -i eth0 -p 94 -j ACCEPT iptables -A INPUT -i tunl9 -p udp --port 520 -j ACCEPT
YMMV depending on the linux flavor/blend.
73 de Marc, LX1DUC
-- 73 de SV1UY Demetre Ch. Valaris IP Coordinator for AMPRnet in Greece e-mail: demetre.sv1uy@gmail.com Radio e-mail: sv1uy@winlink.org (to use my radio e-mail put //WL2K in the beginning of the subject line) https://urldefense.proofpoint.com/v1/url?u=http://www.qsl.net/sv1uy&k=%2... _________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu https://urldefense.proofpoint.com/v1/url?u=http://hamradio.ucsd.edu/mailman/... https://urldefense.proofpoint.com/v1/url?u=http://www.ampr.org/donate.html&a...