Subject: RE: Testing my Network

From: "Y. W. Ko" <[email-masked]>
Date: Mon, 24 Jul 2000 16:30:30 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Sorry I was wrong...

It looks as though you CAN still ping the external interface even though the
internal network address is different - as long as the internal host you
ping from has the firewall configured as the default gateway. I tested it
again, well, after I sent the previous email. I apologise. Having said that,
it still look as though you cannot ping anything beyond the external
interface itself.

Comments please?

Thanks,

	Ko

---------------------------------------------------------------------------
UES Software Inc.                               Tel: (410) 573-2037
175 Admiral Cochrane Drive, Suite 110           Fax: (410) 573-2041
Annapolis, MD 21401.                            E-mail: [email-masked]

> -----Original Message-----
> From: Y. W. Ko [mailto:[email-masked]]
> Sent: Monday, July 24, 2000 3:59 PM
> To: TJ O Connor; Fwtk Users
> Subject: RE: Testing my Network
>
>
> I have come across this myself...
>
> I guess that it happens when both your internal and external
> interface have the same network address, in which case, the
> TCP/IP stack consider them to be on the same subnet. I believe,
> (well, I hope anyway) that the ping that you did from the
> internal network can only go as far as the external interface,
> not beyond. What you might want to do is to reassign reserved
> non-routable ip address such as "198.162.xxx.xxx" to your
> internal network. The behaviour you described would disappear.
>
> Hope this helps,
>
> 	Ko
>
> ------------------------------------------------------------------
> ---------
> UES Software Inc.                               Tel: (410) 573-2037
> 175 Admiral Cochrane Drive, Suite 110           Fax: (410) 573-2041
> Annapolis, MD 21401.                            E-mail:
> [email-masked]
>
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On
> > Behalf Of TJ O Connor
> > Sent: Monday, July 24, 2000 1:15 PM
> > To: Fwtk Users
> > Subject: Testing my Network
> >
> >
> > [To be removed from this list send the message "unsubscribe
> > fwtk-users" in the
> > BODY of a mail message to [email-masked].]
> >
> > Hi,
> >    I am after setting up my own subnet on a linux box to test my
> >    firewall.
> >    I put in a second ethernet card which installed no problem.
> >    When i ran a few tests on the subnet i came up against a slight
> >    problem.
> >
> > I can ping from any computer on my subnet to the inside address of  the
> > firewall system and i can ping from the firewall to an internet system
> > (www.esat.net)
> > However when I try to ping the outside address of the firewall
> > from a computer on the subnet it lets me. I have ip_forwarding
> > turned off by using this command:
> > 'echo "0" > /proc/sys/net/ipv4/ip_forward'
> >
> > if anyone knows what i am talking about could they please
> > email me
> >
> > cheers
> >
> > - --                      _
> > T.J.O'Connor            _/ \_   2200 Cork Airport Business Park,
> > SysAdmin               / \_/ \  Kinsale Rd., Cork, Ireland.
> > Comnitel Technologies  \_/ \_/  Ph: +353 21 7305620
> > [email-masked]    \_/    Fax: +353 21 7305624
> >

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 24 Jul 2000 19:27:59 -0400

On Mon, Jul 24, 2000 at 04:30:30PM -0400, Y. W. Ko wrote:
...
> it still look as though you cannot ping anything beyond the external

I have read about this, as a bug in the network implementation, "to be
fixed in a future release."  And, yes, you can't ping beyond the remote
NIC.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: "Y. W. Ko" <[email-masked]>
Date: Mon, 24 Jul 2000 21:34:14 -0400 (EDT)

Hi Joe,

    Thanks for your comments.

    Do you by any chance remember where the bug was mentioned? Is it Linux
specfic? More importantly, was it specifically mentioned that nothing at
all will be forwarded beyond the "external" interface assuming ip-forward
is disabled? Obviously, everyone need to be very concerned if this is
not true.

    Thanks again,

         Ko

---

From: David Pick <[email-masked]>
Date: Tue, 25 Jul 2000 10:55:59 +0100

> it still look as though you cannot ping anything beyond the external

Perfectly normal. Standard processing for an IP packet when it's
received goes something like:
 1) Is the packet for me?
     - ie is the destination IP address the same as the
       address of *any* interface I have?
    if so, process the packet as such
 2) Since the packet is *not* for me, see if I can route it on
     - am I allowed to forward anything? (ipforwarding variable)
    if not, drop it
    if so, route packet outwards as if I'd sent it myself
     (apart from decrementing the TTL)

-- 
	David Pick