Hi,
Since everyone seems to like to use the most unusual script with
"original" settings without trying ever to understand what's happening,
I would remind you that there is a more or less "plug-and-play" solution
called amprd...
Let's assume a system with:
- 44net assignment: 44.128.1.0/24
- WAN on eth0 (let's assume 1.2.3.4)
- LAN on eth0 (192.168.1.1/24)
- AMPR on eth2 (44.128.1.0/24)
- We choose our GW IP to be 44.128.1.1
and that the internet access from the system is already set up, with NAT
and default gateway via WAN.
Now:
1. compile (make) and install (make install) amprd
2. create the following /etc/amprd.cfg:
-----------------------------------------------------------------
[ampr0]
prefix = 44.128.1.1
rip_receive = yes
rip_save = yes
-----------------------------------------------------------------
3. Set address 44.128.1.1/24 to your eth2 interface
4. Start amprd. And basically that's it: a fully functional mesh gateway.
If you want access from the internet to your subnet, too, instead of
just starting amprd, create the following ampr startup script:
-----------------------------------------------------------------
amprd
ip route add default via 169.228.34.84 dev ampr0 onlink table default
ip rule add from 44.128.1.1 table default
ip rule add from 44.128.1.1 to 44.128.1.0/24 table main
-----------------------------------------------------------------
This should do the trick.
Marius, YO2LOJ
Show replies by date
Of course, you should set up proper firewall rules after getting all
running.
- accept forward with outgoing interface ampr0 only for source addresses
in 44net space
- accept only the incoming services you need
- NAT outgoing raffic to the GW IP
Just an example - accept only 44net to 44net traffic:
------------------------------------------
iptables -A FORWARD -s 44.128.1.0/24 -o ampr0 -j ACCEPT
iptables -A FORWARD -o ampr0 -j DROP
iptables -A INPUT -s 44.0.0.0/8 -i ampr0 -j ACCEPT
iptables -A INPUT -i ampr0 -j DROP
iptables -A OUTPUT ! -s 44.128.1.0 -o ampr0 -j DROP
------------------------------------------
Have fun.
Marius, YO2LOJ