A Routing problem.. Please help? :-/

Printable View

March 26th, 2003, 04:36 PM
ostefan

A Routing problem.. Please help? :-/

Hi!

I don't know if this is the right place for the question I have, but it's related to a honeynet, so I take my chances.

I have a router that's configured with two ethernet devices, one points to the Internet, and the other one to my network.

The router config looks like this: (the ip-addresses are fake..)
----
interface Ethernet0
ip address 219.18.129.205 255.255.255.252
half-duplex
!
interface FastEthernet0
ip address 84.12.145.41 255.255.255.248
speed auto
half-duplex
!
ip default-gateway 219.18.129.206
ip classless
ip route 0.0.0.0 0.0.0.0 219.18.129.206
ip route 84.12.145.40 255.255.255.248 FastEthernet0
ip route 194.19.32.96 255.255.255.224 FastEthernet0
----
And as you can see I have two public networks 84.12.x.x and 194.19.x.x, and I want to
route both those network into my network (Fast0). And this seems to be working just fine.

On the inside I have a Debian 2.4.18-x server with two network cards:

eth0
inet addr:84.12.145.43 Bcast:84.255.255.255 Mask:255.255.255.248

eth1
inet addr:194.19.32.97 Bcast:194.19.32.127 Mask:255.255.255.224

The routing table looks like this:
----
Destination Gateway Genmask Flags Metric Ref Use Iface
84.12.145.40 0.0.0.0 255.255.255.248 U 0 0 0 eth0
193.71.32.96 0.0.0.0 255.255.255.224 U 0 0 0 eth1
0.0.0.0 84.12.145.41 0.0.0.0 UG 0 0 0 eth0
----

And connected to eth1 I have another Debian server with one interface:

eth0
inet addr:194.19.32.98 Bcast:194.19.32.127 Mask:255.255.255.224

And the routing table looks like this:
----
Destination Gateway Genmask Flags Metric Ref Use Iface
194.19.32.96 0.0.0.0 255.255.255.224 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 194.19.32.97 0.0.0.0 UG 0 0 0 eth0
----

I thought that this should work, but it doesn't. When I ping Debian server #2
server (194.19.32.98) from Debian server #1 (194.19.32.97) it answers and everything
looks fine. And it works fine the other way around as well.

And if I try to ping eth0 (84.12.145.43) from Debian server #2 (194.19.32.98) I get
an answer.

But, if I try to ping the router (84.12.145.41) I get no answer.

I have connected a hub between Debian server #1 and the router and I am trying to
tcpdump/tethereal to find out what's happening.

The ping goes through, but Debian server #1 (84.12.145.43) does not want to tell
the router (84.12.145.41) where to find Debian server #2 (194.19.32.98).
-----
0.000000 194.19.32.98 -> 84.12.145.41 ICMP Echo (ping) request
0.001085 00:14:d1:3f:4a:f1 -> ff:ff:ff:ff:ff:ff ARP Who has 194.19.32.98? Tell 84.12.145.41
0.729126 00:14:d1:3f:4a:f1 -> 00:14:d1:3f:4a:f1 LOOP Loopback
-----

I suspect that I cannot see the forest because the trees are in my view, and that the
Loopback message should tell me something. But, I am a blank.

Does anyone have any suggestions? Please? I am going slightly mad.. (Blupp)

Maybe I am attacking this the wrong way, and I appreciate any suggestion at this moment.

Thanks!

- Ole S -
March 26th, 2003, 04:43 PM
SirDice

Re: A Routing problem.. Please help? :-/

Quote:

Originally posted here by ostefan
ip default-gateway 219.18.129.206
ip classless
ip route 0.0.0.0 0.0.0.0 219.18.129.206
ip route 84.12.145.40 255.255.255.248 FastEthernet0
ip route 194.19.32.96 255.255.255.224 FastEthernet0

The ip route 84.12.145.40 255.255.255.248 FastEthernet0 isn't needed because it's a direcly connected network.

What does a show route tell you on the router?
March 26th, 2003, 04:54 PM
ostefan

'show route' doesn't turn out anything.. Just blanks..
March 26th, 2003, 04:56 PM
SirDice

Quote:

Originally posted here by ostefan
'show route' doesn't turn out anything.. Just blanks..

Doh! It should be show ip route. My mistake :(

It is a cisco router isn't it?
March 26th, 2003, 05:00 PM
d0ppelg@nger

You can put a secondary IP address on the FastE0
Command
ip address 194.19.32.xx 255.255.255.224 secondary

This would allow you to route on the FastE0 interface
March 26th, 2003, 05:02 PM
ostefan

Eh.. I should have know too.. Sorry..

Yes, a cisco 1721..

Gateway of last resort is 217.8.129.206 to network 0.0.0.0

84.12.0.0/29 is subnetted, 1 subnets
C 81.12.145.40 is directly connected, FastEthernet0
219.18.129.0/30 is subnetted, 1 subnets
C 219.18.129.204 is directly connected, Ethernet0
194.19.32.0/27 is subnetted, 1 subnets
S 194.19.32.96 is directly connected, FastEthernet0
S* 0.0.0.0/0 [1/0] via 219.18.129.206
March 26th, 2003, 05:02 PM
SirDice

Quote:

Originally posted here by d0ppelg@nger
You can put a secondary IP address on the FastE0
Command
ip address 194.19.32.xx 255.255.255.224 secondary

This would allow you to route on the FastE0 interface

This should not be necessary. As long as all the ip addresses, netmasks and routes are correct.
March 26th, 2003, 05:08 PM
ostefan

And, that another question.. Do I really have to use a public ip-address on the interfaces that's against my network? I mean, shouldn't it be possible to route a network over another network? I.e Fast0 (on the router) 192.168.0.1/30, and on the Debian server #1 eth0 192.168.0.2/30? I thought that was possible, and I would save public ip-addresses..
March 26th, 2003, 05:09 PM
d0ppelg@nger

What's up with the BCast on this interface

eth0
inet addr:84.12.145.43 Bcast:84.255.255.255 Mask:255.255.255.248
March 26th, 2003, 05:11 PM
ostefan

And it looks like Debian Server #1 actually routest the ping to the router and that the router answers, but cannot find the route back to Debian server #2..

And the MAC is know by Debian server #1. At least I can see it when I issue a arp -a command.
March 26th, 2003, 05:11 PM
SirDice

Re: A Routing problem.. Please help? :-/

Quote:

Originally posted here by ostefan
interface Ethernet0
ip address 219.18.129.205 255.255.255.252
half-duplex
!
interface FastEthernet0
ip address 84.12.145.41 255.255.255.248
speed auto
half-duplex
!
ip default-gateway 219.18.129.206
ip classless
ip route 0.0.0.0 0.0.0.0 219.18.129.206
ip route 84.12.145.40 255.255.255.248 FastEthernet0
ip route 194.19.32.96 255.255.255.224 FastEthernet0

I may have found it. Remove all the ip routes. And just add this:

ip default-gateway 219.18.129.206
ip route 194.19.32.96 255.255.255.224 84.12.145.43

That should make it work.

The ip route 194.19.32.96 255.255.255.224 FastEthernet0 told the router the 194.19.32.96 network was directly connected to FastEthernet0. It isn't, it should be routed by Debian #1.
March 26th, 2003, 05:12 PM
d0ppelg@nger

Do you own all these IP's?

I would use private addresses
172.16.x.x-172.31.x.x
10.x.x.x
192.168.x.x

on any private interface and NAT that to the internet
March 26th, 2003, 05:18 PM
ostefan

Don't know what's up with the bcast address.. It should read 84.12.145.47.

I changed it manually, so now it looks like this:

eth0
inet addr:84.12.145.43 Bcast:84.12.145.47 Mask:255.255.255.248

It didn't help though..

:(

Quote:

Originally posted here by SirDice

I may have found it. Remove all the ip routes. And just add this:

ip default-gateway 219.18.129.206
ip route 194.19.32.96 255.255.255.224 84.12.145.43

That should make it work.

The ip route 194.19.32.96 255.255.255.224 FastEthernet0 told the router the 194.19.32.96 network was directly connected to FastEthernet0. It isn't, it should be routed by Debian #1.

YES!!!! IT WORKS!!
Thank allot SirDice, you've made my day, the whole week!!

:D

- Ole S -
Oslo/Norway
March 26th, 2003, 05:41 PM
SirDice

Quote:

Originally posted here by ostefan
YES!!!! IT WORKS!!
Thank allot SirDice, you've made my day, the whole week!!

Glad to help. Had to make a little drawing on paper to figure it out though.

Do you understand why it didn't work? That's the whole point of this exercise ;)
March 26th, 2003, 05:54 PM
Networker

Tell me if I'm wrong!

addresses & related mask seem weird:

e.g. 84.12.145.40 255.255.255.248
the mask means that the last byte is masked, in binary, by 11111000
so addresses belonging to that network are:
11111000: 248
11111001: 249
11111010: 250
11111011: 251
11111100: 252
11111101: 253
11111110: 254

84.12.145.40 does not belong to the subnet
March 26th, 2003, 08:00 PM
ostefan

Quote:

Originally posted here by Networker
Tell me if I'm wrong!

addresses & related mask seem weird:

e.g. 84.12.145.40 255.255.255.248
the mask means that the last byte is masked, in binary, by 11111000
so addresses belonging to that network are:
11111000: 248
11111001: 249
11111010: 250
11111011: 251
11111100: 252
11111101: 253
11111110: 254

84.12.145.40 does not belong to the subnet

Well.. if you try using a ipcalc of some kind it seems that 84.12.145.40/29 is a valid
subnet. the 84.12.145.40 address it the subnet address, 84.12.145.47 is the bcast address.
Maybe someone else can give the binary explanation? This is kind of new to me. :)

Quote:

Originally posted here by SirDice

Glad to help. Had to make a little drawing on paper to figure it out though.

Do you understand why it didn't work? That's the whole point of this exercise ;)

Hi,
Yes, I think I understand why it didn't work. As you said, the ip route 194.19.32.96 255.255.255.224 FastEthernet0 told the router to look for any address in that range on the router itself. And that doesn't do any good. The router cannot answer it's own requests. I guess the result will be some kind of loopback?
March 26th, 2003, 10:59 PM
SirDice

Quote:

Originally posted here by ostefan
Hi,
Yes, I think I understand why it didn't work. As you said, the ip route 194.19.32.96 255.255.255.224 FastEthernet0 told the router to look for any address in that range on the router itself. And that doesn't do any good. The router cannot answer it's own requests. I guess the result will be some kind of loopback?

Allmost. There's no loopback. It just thought the host was connected to a segment on one of it's own interfaces. That's why you saw the ARP request on that segment. It should hand the packet over to Debian#1 and forget about it. Just let Debian#1 figure out where it goes next.

As for the subnetmask, the last 3 bits are for the hosts and the rest is to assign the network-number. As you said use an IP subnet calculator if you're not sure.
84.12.145.40 with netmask 255.255.255.248 is

84.12.145.40 (network address, don't use)
84.12.145.41 (first host in 84.12.145.40/29)
..
..
84.12.145.46 (last host in 84.12.145.40/29)
84.12.145.47 (subnet broadcast address)

(notice the 0..7 here, 3 bits ;)

This means 84.12.145.48/29 is the next subnet.
March 27th, 2003, 10:34 AM
Networker

Well, well, well,
I'm maybe from the old scholl? But I think that's more understandable in binary. I've to say you're absolutely right SirDice. (And I apologize for the poor quality of my previous post ;) )

Quote:

Sirdice wrote:
As for the subnetmask, the last 3 bits are for the hosts and the rest is to assign the network-number. As you said use an IP subnet calculator if you're not sure. [....]

Let me explain my theoritical point of view:
As example the subnet is 1.1.1.40/29 that's mean

Byte 1 Byte 2 Byte 3 Byte 4
Subnet @ 00000001 00000001 00000001 00101000
Mask 11111111 11111111 11111111 11111000
=>
Filter (inv AND) 11111110 11111110 11111110 11010111

The filter is used in the routing process to compare incoming frame with the route in the routing tabel there is one filter per route.

Incomming Packet to 1.1.1.44: Its binary value is compare to the filter
Packet 00000001 00000001 00000001 00101100
Filter 11111110 11111110 11111110 11010111
Result (AND) 11111111 11111111 11111111 11111111
The result is 255.255.255.255 => frame fits the route

Incomming Packet to 1.1.1.54: Its binary value is compare to the filter
Packet 00000001 00000001 00000001 00110110
Filter 11111110 11111110 11111110 11010111
Result (OR) 11111111 11111111 11111111 11110111
The result is not 255.255.255.255 => frames does not fit the route
March 27th, 2003, 11:27 AM
SirDice

That's about it Networker :-)

Seeing that so many ppl still have trouble with ip subnet calculation i will see if i can write a proper tutorial about it (if i can find some spare time). Also alot of ppl don't know how to convert decimal to binary or hexadecimal, so i might do that one too.