🚀 go-pugleaf

Casey Claiborne wrote:
> 
--cut--
> 
> After doing lots of testing, I have found that the reason
> why the two machines will not talk to each is other is a
> routing problem.
> 
> Casey

Casey you hit it on the head there. You need to do the following:

The router's port on the ISDN side gets the IP address provided to you
by the service provider. The provider also needs to give you a network
address for the network around the hub (or you need to ask for one from
the Internet authorities and then register its use with the service
provider). In this way they can then route all traffic for your network
down their ISDN line to you.

If they have given the router, pentium and 486 all individual IP
addresses on the same IP network then each packet has to travel the
length of the ISDN to find its ultimate destination (even if its linked
to the local hub!) hence why your network works while the ISDN is
active. 

Given the previous case (your own network) you then place in each
machine's routing table two entries:

route add -net 'localnet' dev eth0 metric 1
route add default gw 'router-ip-address' metric 1

Now your network is active and local traffic knows where to go. (By the
way you must enter the commands in that order, else you will get a "no
route to IP address from the "add default" command.)

Incidentally, if the service provider has given you a network, its
likely to be a small subnet of a larger range. You must code the correct
netmask on the "ifconfig" command for the above to work in all cases and
avoid using the first and last IP address of the range (these are the
broadcast addresses).

If they have provided you with case 2, individual IP addresses, all is
not lost, you must simply explicitly add routes for each host into the
routing table and then the default route via the router.
eg on the 486:

route add -host 'pent-ip-addr' dev eth0 metric 1
route add -host 'router-ip-addr dev eth0 metric 1
route add default gw 'router-ip-addr' metric 1

and then you should be cooking.


On your second point, disconnecting the 486 from the network, simple,
you don't even have to remove anything physical. Simply "ifconfig eth0
down" the link. Then external agents can't do anything to the box.
Because now the kernel isn't listening to the ethernet card.

Your backup script then contains "ifconfig eth0 up; backitup;ifconfig
eth0 down". and then you only have the link active as long as you need.

Further, if this is still a worry, disable inetd or entries in
/etc/inetd.conf for those facilities you are never going to use. EG if
you are always only telnetting from the 486 to the pentium, then remove
the telnetd entry, you don't use it, why should other people? Same is
true for rlogind, rshd, ftpd and the portmapper facilities. These are
rarely if ever needed on a purely client machine. Also read your router
manual, in most cases it is possible to tell the router to barr
undesired traffic. EG if your pentium is only offering web services then
tell your router to filter out all unsolicited requests to your network
other than for services to port 80. (TCP packets have a flag in them
telling the network if the packet is a reply (a solicited message) to an
original request. So for instance if you telnet out over the ISDN, all
returning packets have this flag set, however someone trying to telnet
you, being unsolicited, has this flag clear. The router can filter on
this.)

Chris Cradock
cradockc@oup.co.uk