FANDOM


projects Edit

https://fossies.org/diffs/ipfire/2.x-2.19-core103_vs_2.x-2.19-core104/lfs/htop-diff.html

Firewalling Edit

Firewalling issue
QUES:
>I need to be able to plug-in a MeshAP (it will be the uplink node or
>gateway for the mesh) into an available CAT5 port on a switch or
>router that will be either static IP or hand out DHCP IP address
>(needs to work for both methods) of a private business network to
>get its Internet access. BUT, this is the tricky part, the wireless
>users using this MeshAP gateway must NOT be able to see or access
>the private business network. See below-
ANSw:
Simple built in solution available:
Total block on incoming wired:
This locks down a wired LAN that is connected via the mesh, to
make a high security firewalled connection.
http://live.locustworld.com/tracker/wiki?p=FireWalling
Wireless connections can only connect to the gateway and out - they
can't connect to devices on the LAN.

> there is a wiana setting radio button (yes or no option) for "same > node clients firewalled" - see the "firewalling" section, last entry > above "dialup settings"
This is a bit too broad - I only want to remove the firewall for a single wireless client. IIRC, this setting is processed by iptables.. Qorvus have some info on the details on their website. I wonder if adding the client to the NoCat_Inbound chain will be enough?


SAME NODE CLIENTS FIREWALL Edit

If you turn the SAME NODE CLIENTS FIREWALL NO this should open up the firewall and allow the printer to be seen. This also opens up your network so is not recommended.

I have a mesh AP connected to a router at home. My desktop computers are networked via workgroup and I share a printer among them. How can I access my shared printer on the workgroup side of the LAN via my wirelless connected laptop that is going through the mesh ap.

> laptop <----------(wireless connection)<----------------Mesh > ap<----------------------router<------------------(cat5 > cable)<---------------desktop----------shared printer. > > Can I get the ultra simplified version??

StormWarning Edit

> 192.168.1.100 is connected wirelessly to the gateway radio.

> 192.168.2.100 is connected through a router and feeds the local mesh.

> meshbox kernel: STORMWARNING: IN=eth0 OUT= > MAC=00:40:63:d4:b6:a7:00:0e:2e:05:3e:be:08:00 SRC=192.168.1.100 > DST=192.168.2.100 LEN=99 TOS=0x00 PREC=0xC0 TTL=63 ID=2446 PROTO=ICMP > TYPE=3 CODE=3 [SRC=192.168.2.100 DST=192.168.1.100 LEN=71 TOS=0x00 > PREC=0x00 TTL=63 ID=31218 DF PROTO=UDP SPT=1030 DPT=53 LEN=51 ]

It's an iptables rule that limits icmp packets.

It  : - is not applied on the internals of the mesh (172.16/16) - limits icmp to 30/s from your clients (192.168/16) - limits icmp to 5/min and adds an entry in the syslog with the prefix STORMWARNING if it comes from an other IP than the previous ones.

It's strange that you get such a message with 2 192.168/16 IPS. I thought you would fall into case 2.

Any idea ?

You can comment the rules in /etc/rc.d/rc.firewall if it annoys you.

=============Edit

Dave,

That's a PacketStorm. It is similar to the issue that Kyle just saw on his network - although it was with clients, while this appears to be between nodes. Looking at this below, here's what I see. It is on a bridged interface (br0) - so it's likely an issue from node to node only. If it were on wlan0, it would be node to client. SRC is one of your nodes - 1.110.146.200 DST is another node - 1.155.80.161

  • If you look on down, you will see another DST 1.24.71.99. I would

assume that one of the DST 's is the gateway, likely the 1.24.71.99 address.

If you are running dev74 on this node, the "threshold" for stormwarnings was set too low, and that was supposedly fixed in dev76. If you are dev76 or later, it likely really is a stormwarning. Packetstorms can really mess up a mesh network.

I'd suspect that maybe there is a weak link from one node to the other? Or possibly some interference. I think that this indicates that a number of packets were stored, then forwarded all at once.

Maybe someone else will build more on this.

Kb


{{{ > Can anyone tell me what this means? I am seeing it on one of my nodes. > > 1.155.80.161@meshbox:~# > Message from syslogd@meshbox at Fri Sep 17 22:17:24 2004 .. > meshbox kernel: STORMWARNING: IN=br0 OUT= > MAC=00:02:6f:09:a4:18:00:02:6f:08:12:5 > 9:08:00 SRC=1.110.146.200 DST=1.155.80.161 LEN=152 TOS=0x00 PREC=0xC0 > TTL=64 ID= > 29928 PROTO=ICMP TYPE=3 CODE=1 [SRC=1.155.80.161 DST=1.24.71.99 > LEN=124 TOS=0x00 > PREC=0x00 TTL=63 ID=26063 PROTO=177 ]

> Message from syslogd@meshbox at Fri Sep 17 22:17:34 2004 ... > meshbox kernel: STORMWARNING: IN=br0 OUT= > MAC=00:02:6f:09:a4:18:00:02:6f:08:12:5 > 9:08:00 SRC=1.110.146.200 DST=1.155.80.161 LEN=168 TOS=0x00 PREC=0xC0 > TTL=64 ID= > 29938 PROTO=ICMP TYPE=3 CODE=1 [SRC=1.155.80.161 DST=1.24.71.99 > LEN=140 TOS=0x00 > PREC=0x00 TTL=63 ID=26073 PROTO=177 ]

> Message from syslogd@meshbox at Fri Sep 17 22:17:39 2004 ... > meshbox kernel: STORMWARNING: IN=br0 OUT= > MAC=00:02:6f:09:a4:18:00:02:6f:08:12:5 > 9:08:00 SRC=1.110.146.200 DST=1.155.80.161 LEN=184 TOS=0x00 PREC=0xC0 > TTL=64 ID= > 29944 PROTO=ICMP TYPE=3 CODE=1 [SRC=1.155.80.161 DST=1.24.71.99 > LEN=156 TOS=0x00 > PREC=0x00 TTL=63 ID=26079 PROTO=177 ]

> Message from syslogd@meshbox at Fri Sep 17 22:19:19 2004 ... > meshbox kernel: STORMWARNING: IN=br0 OUT= > MAC=00:02:6f:09:a4:18:00:02:6f:08:12:5 > 9:08:00 SRC=1.110.146.200 DST=1.155.80.161 LEN=184 TOS=0x00 PREC=0xC0 > TTL=64 ID= > 29971 PROTO=ICMP TYPE=3 CODE=1 [SRC=1.155.80.161 DST=1.24.71.99 > LEN=156 TOS=0x00 > PREC=0x00 TTL=63 ID=26160 PROTO=177 ]

> Message from syslogd@meshbox at Fri Sep 17 22:19:34 2004 ... > meshbox kernel: STORMWARNING: IN=br0 OUT= > MAC=00:02:6f:09:a4:18:00:02:6f:08:12:5 > 9:08:00 SRC=1.110.146.200 DST=1.155.80.161 LEN=184 TOS=0x00 PREC=0xC0 > TTL=64 ID= > 29987 PROTO=ICMP TYPE=3 CODE=1 [SRC=1.155.80.161 DST=1.24.71.99 > LEN=156 TOS=0x00 > PREC=0x00 TTL=63 ID=26180 PROTO=177 ] > 1.155.80.161@meshbox:~# }}}


Links Edit

See HjDetectMode

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.