I have a RH 6.2 linux box that serves as a gateway to the internet for my LAN. I currently use IP MASQ'ing (via ipchains) to have my network connect to the internet and serve as a firewall but now I am running into troubles with all the new protocols out there (such as PPTP).

Without really going into the details of the above, I have a question. Does anyone know if I can set up my box to act as a router but still use ipchains as my firewall, without it doing any masq'ing? If so, how? (I am using 2.2.17-5.0 the stock out of the box RH 6.2 kernel.)

Can routing be done without ip masq'ing?

Andy

Hi.
I have an idea that IPchains can do it, but the internal comps need a valid public IP address.

The Linux box will use RIP, routing information protocol to do this, then forward any packets to the net hop in it's FIB table. "i.e static routes set-up by you"

Ipchains must not do the MASQ option just normal rules.
Wazzas right you'll need a real IP.

Use NAT/MASQ it's easyer.

/Raz

Well, if I have to use private ip on my internal network, I am going to have to ask another question. My original problem is that I cannot get VPN from a WinME client behind my firewall to a WinNT vpn server outside my firewall working. Everywhere I go says to use the ip_masq_pptp module which I cannot find. Does anyone know if it is included with 2.2.* kernels higher than 2.2.17??? (Just so I can upgrade my kernel and not patch my current one.)

Andy

The best way to get this to work is to use Kernel 2.4 which comes with support for forwarding VPN connections. I tried several different ways to get it to work with the 2.2 kernel but the only way I was able to get results was compiling and using a 2.4 kernel.

If you can remember, was there anything in specific that that you had to compile to make your vpn connection work (besides the obvious things to get masq'ing working)? Are you using iptables or ipchains?

Andy

Kernel 2.4 only uses IPtables. IPchains is no longer used. Under "Networking Options", say "yes" to "Network Packet Filtering" and "IP tunneling"

I think thats all you need to Masq PPTP connections.

If you want to route without IPMasq, you will need "real" IP addresses for all the boxes you want to route out to the net.

Just installed 2.4.4 and VPN works great! Thanks for all your help guys!

Andy

There is a suboption (at least in 2.4.4) to allow continued use of IPChains...

I was trying to use ipchains to maintain my current firewall but I found out that I needed to compile pptp into the kernel for it. Either way, I was able to get a iptables firewall with vpn support working before I was able to get the ipchains working. So I kept it...