subnetting and ip addresses with ipcop

ok, so this ones got me stumped. I have an ipcop, and it's on its subnet .0.1 and it connects to the internet on its red (bad interface) and green to the internal subnet (good, home, .0.1) which just goes to a wireless router. I used a crossover cable to connect em and everything works great. I have one issue though, the ipcop doesn't see or know any of the ip addresses on my home network, so all my logs are incomplete (i just get .0.200 for ip addresses in my home network rather than .1.x). Also, i wanted to set up a transparent proxy to a content filtering system on a server on my home subnet, but i cant because it would filter the content filterer to, creating an infinite loop

i.e. my computer wants isohunt.com, ipcop sends the request through to my wireless router (.0.200:8118) which forwards to server (.1.x:8118) which asks for the page and is caught by ipcop, which repeats the process.

I have the option of giving a computer unrestricted access, which would work and is the solution i need, but ipcop doesnt have any clue who 192.168.1.x is and where he is.
So how do i fix it?
isnt there a way in linux using ifconfig or hosts or something to say which interface an ipaddress is on? is that even what i want? I guess i could put a hub on ipcop, then a crossover to the hub for my router, and then the server on the hub. but then i have to move other services and reconfigure and stuff. Maybe one day I'll do that but not today. Anyways, any help would be appreciated, later and thanks

Does your set-up reflect this:

Internet -->-->--> IPCOP F/W -->-->--> Wireless AP -->-->--> Wireless clients

And from the firewall > Router > Hosts everything is on a 192.168.0.X/24 IP range?

close, sorry. that was probably unclear

internet --> ipcop (f/w and proxy) (.0.1) -->(.0.200) Wireless AP (.1.2) --> (.1.x) clients/home network and server

Why cant you set all your network devices to be on the same subnet?

i like the two subnets for lots or reasons. I think i'll leave it at that so that we dont get off topic

I don't think it is possible to work the way it is setup.

poop, thats no fun. u sure? well how about just simple things like if i wanted to ping 192.168.1.1 from the ipcop? i'm sure thats gotta be possible

This sounds rather similar to the setup I have.

My setup:


internet-->ipgateway(192.168.1.1)-->(192.168.1.2)wireless router(192.168.2.1)-->me(192.168.2.x)

My gateway thinks all traffic that's coming from behind the router is coming from 192.168.2.1, because the wireless router does all the DHCPing, NATing and stuff.

Btw, I do the ipgateway thing because it's hard sharing a dialup connection otherwise.

Going off the info you have provided I think you have a routing issue - as someone mentioned if your Wireless AP is handing out the IP addresses to your clients, then something needs to tell the firewall about the subnet and how to reach it - I wouldn't have thought the wireless AP would do this, unless you have a high end one.

So for example when the firewall is told to ping 192.168.1.X if has no idea where that subnet is our how to get to it - in fact it will have a default route in place to send all unknown traffic to your ISP's router and on to the Internet, however obviously the 192.168 range is not routable over the Internet.

I've not used IPCOP before but I suppose there must be a way to configure a static route in it to tell it to send all 192.168.1.x traffic to the wireless AP.

At the moment your wireless AP will NAT the 192.168.1.x subnet to 0.200 address (which will explain the log entries you are seeing) so as far as the firewall is concerned there is only the 0.200 address on that interface.

A rule similar to the following would be needed

route 192.168.1.0 255.255.255.0 -> 192.168.0.200.

This way the Wireless AP will receive the traffic and as it knows about the other IP range it will send it on as normal.

No im not sure but I dont think its possible with that setup... maybe some one else has some ideas.

My setup looks similar but without the ipcop. Check your routing tables. The wireless clients should have their default gateway set to the AP. Your ipcop should have it's default gateway pointing to your internet gateway.

No need for NAT on the AP just as long as the routing is correctly setup.

Hi - My Google IpCop alert brought me here - nice to meet you all.

This seems to be a common IpCop scenario and the best way to sort it is to install a another NIC in the Cop, set it up as the Blue interface and attach your WAP / router here for your wireless network ONLY. Then attach a standard hub / switch to the Green interface (your old NIC) for your wired network.

Your IpCop now has two subnets using the Cop as the default gateway and, with the addition of the Blue interface, you will find extra options under the Firewall & Services webadmin tabs to control access between the Green & Blue subnets.

Hope this helps.

Welcome to the forum,Mick!

Try adding a persistant route to your static routes file. I have a smoothwall so I'm not sure where the applicable file is. In smoothwall it's at:
/var/smoothwall/ethernet/static-routes

Add this line:

route add -net 192.168.1.0 gateway 192.168.0.200 netmask 255.255.255.0

I am going to go out on a limb and say your "wireless ap" is actually a wireless broadband router and has NAT enabled. Thus you cant ping from 0.x to 1.x , but you should be able to ping from 1.x to 0.x. This is a basic feature of nat and unless you have a static entry with a translation it isn't possible. I recommend you follow the above suggestion and get another NIC for your ipcop box.

I must say that this sounds very close to my setup.

Which means that Net2Infinity is right on the money.

My setup replaces ipcop with m0n0wall but looks like this


cable -- (24.x.x.x) m0n0wall

m0n0wall1 (1.1/24) -- (1.2/24)Wireless Router
m0n0wall2 (3.1/24) -- (3.2/24)VoIP Gateway
VoIPGateway(4.1/24) -- "test subnet" (4.x/24)
Wireless Router (2.1/24) -- Home Network (2.x/24)

I'm using 4 subnets, and everything works as intended..

The NAT router is why your IPCop install doesn't know where your 1.x:8118 is. IPCop speaks to your router 0.200 and only that address... As far as IPCop is concerned, your router is the server it is speaking to... it doesn't know that anything exists behind you.

I have the same issue with my setup.. So here's what you do.

All forwarding rules/ fire exceptions in IPCop point to the wifi router interface that it can see (0.200).... Inside 0.200 you have it setup to do port forwarding to the server you want to speak with (or put a single server in the DMZ)... Everything will function properly... As I said this is my every day setup and I'm making use of plenty of servers.

I hate to bring up dead posts, so excuse the bad practice, but I was googling around for some different things and this came up so I thought I'd give my final solution to the problem.

There are two solutions, but one takes a little more money and it wasnt as convenient (rewiring and buying a hub). Ultimately I ended up doing a bit of both cause I wanted some increased functionality (I bought a web managed switch and put it on the .0.x subnet and moved all servers and high traffic devices there).

Basically r4nd0m1z and everyone who said i just needed to add a new route was correct, I just didnt know how to do it at the time. That was basically my problem, I could ping from the inside out because all the routes were set up exactly as SirDice said but that means I can only go one way, not both (my IPCop had no idea where .1.x was because it didnt have a route for that, only that anything not .0.x was on the internet).

Adding another NIC was the other option but I didnt feel like creating a whole other subnet at the time and buying a hub and what not (I bought the switch but thats besides the point :p )

So my architecture looks like this now:
Internet --> IPCop (.233.2)--> Switch --> (.233.x) Servers and Wireless AP (.1.2) --> (.1.x) wireless clients

I ended up doing a bit of both, but if you're looking for the no money solution go with the route add posted by r4nd0m1z on your IPCop. Thats about it and thanks for all the suggestions guys, I really do love this forum