tomato-interface: Current Routing Table Destination Gateway / Next Hop Subnet Mask Metric Interface 91.67.36.254 * 255.255.255.255 0 vlan2 (WAN) 172.16.2.0 * 255.255.255.0 0 br0 (LAN) 192.168.2.0 * 255.255.255.0 0 br1 (LAN1) 91.67.36.0 * 255.255.255.0 0 vlan2 (WAN) 127.0.0.0 * 255.0.0.0 0 lo default 91.67.36.254 0.0.0.0 0 vlan2 (WAN) --------------------------------------------- dasselbe: root@unknown:/tmp/home/root# netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 91.67.36.254 0.0.0.0 255.255.255.255 UH 0 0 0 vlan2 172.16.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br1 91.67.36.0 0.0.0.0 255.255.255.0 U 0 0 0 vlan2 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 91.67.36.254 0.0.0.0 UG 0 0 0 vlan2 ---------------------------- root@unknown:/tmp/home/root# ifconfig br0 Link encap:Ethernet HWaddr 74:44:01:33:5D:1E inet addr:172.16.2.1 Bcast:172.16.2.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:583414 errors:0 dropped:0 overruns:0 frame:0 TX packets:795604 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:72137398 (68.7 MiB) TX bytes:872863178 (832.4 MiB) br1 Link encap:Ethernet HWaddr 74:44:01:33:5D:1E inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:170549 errors:0 dropped:0 overruns:0 frame:0 TX packets:232046 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:23657666 (22.5 MiB) TX bytes:240453295 (229.3 MiB) eth0 Link encap:Ethernet HWaddr 74:44:01:33:5D:1E UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:9029198 errors:0 dropped:0 overruns:0 frame:0 TX packets:1595032 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1708697417 (1.5 GiB) TX bytes:939864962 (896.3 MiB) Interrupt:4 Base address:0x2000 eth1 Link encap:Ethernet HWaddr 74:44:01:33:5D:20 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:218501 errors:0 dropped:0 overruns:0 frame:2902582 TX packets:455597 errors:144 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:30956092 (29.5 MiB) TX bytes:302086942 (288.0 MiB) Interrupt:3 Base address:0x1000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1 RX packets:3463 errors:0 dropped:0 overruns:0 frame:0 TX packets:3463 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:646754 (631.5 KiB) TX bytes:646754 (631.5 KiB) vlan1 Link encap:Ethernet HWaddr 74:44:01:33:5D:1E UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:533012 errors:0 dropped:0 overruns:0 frame:0 TX packets:890761 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:69706204 (66.4 MiB) TX bytes:838837448 (799.9 MiB) vlan2 Link encap:Ethernet HWaddr 74:44:01:33:5D:1F inet addr:91.67.36.241 Bcast:91.67.36.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8496179 errors:0 dropped:0 overruns:0 frame:0 TX packets:701796 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1476465299 (1.3 GiB) TX bytes:100834622 (96.1 MiB) vlan3 Link encap:Ethernet HWaddr 74:44:01:33:5D:1E UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:2475 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:192892 (188.3 KiB) wl0.1 Link encap:Ethernet HWaddr 76:44:01:33:5D:21 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:168242 errors:0 dropped:0 overruns:0 frame:0 TX packets:233312 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:25704264 (24.5 MiB) TX bytes:242456587 (231.2 MiB) ************ root@unknown:/tmp/home/root# traceroute 192.168.2.1 traceroute to 192.168.2.1 (192.168.2.1), 30 hops max, 38 byte packets 1 unknown-lan1 (192.168.2.1) 0.068 ms 0.042 ms 0.040 ms root@unknown:/tmp/home/root# ping 192.168.2.1 PING 192.168.2.1 (192.168.2.1): 56 data bytes 64 bytes from 192.168.2.1: seq=0 ttl=64 time=0.441 ms 64 bytes from 192.168.2.1: seq=1 ttl=64 time=0.449 ms 64 bytes from 192.168.2.1: seq=2 ttl=64 time=0.403 ms 64 bytes from 192.168.2.1: seq=3 ttl=64 time=0.401 ms --- 192.168.2.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 0.401/0.423/0.449 ms ************ root@unknown:/tmp/home/root# ping 172.16.2.0 PING 172.16.2.0 (172.16.2.0): 56 data bytes --- 172.16.2.0 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss ************ root@unknown:/tmp/home/root# ping 172.16.2.1 PING 172.16.2.1 (172.16.2.1): 56 data bytes 64 bytes from 172.16.2.1: seq=0 ttl=64 time=0.545 ms 64 bytes from 172.16.2.1: seq=1 ttl=64 time=0.454 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.454/0.499/0.545 ms ************ root@unknown:/tmp/home/root# traceroute 172.16.2.1 traceroute to 172.16.2.1 (172.16.2.1), 30 hops max, 38 byte packets 1 unknown (172.16.2.1) 0.072 ms 0.043 ms 0.040 ms ************ root@unknown:/tmp/home/root# cat /etc/hosts 127.0.0.1 localhost 172.16.2.1 unknown unknown-lan 192.168.2.1 unknown-lan1 ************ root@unknown:/tmp/home/root# cat /etc/iptables *mangle :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :WANPREROUTING - [0:0] -A PREROUTING -d 91.67.36.241 -j WANPREROUTING -A PREROUTING -i vlan2 -d 172.16.2.1/255.255.255.0 -j DROP -A PREROUTING -i vlan2 -d 192.168.2.1/255.255.255.0 -j DROP -A WANPREROUTING -p icmp -j DNAT --to-destination 172.16.2.1 -A WANPREROUTING -p tcp --dport 21 -j DNAT --to-destination 172.16.2.103 -A POSTROUTING -o vlan2 -j MASQUERADE -A POSTROUTING -o br0 -s 172.16.2.1/255.255.255.0 -d 172.16.2.1/255.255.255.0 -j SNAT --to-source 172.16.2.1 -A POSTROUTING -o br1 -s 192.168.2.1/255.255.255.0 -d 192.168.2.1/255.255.255.0 -j SNAT --to-source 192.168.2.1 COMMIT *filter :INPUT DROP [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state INVALID -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -N shlimit -A shlimit -m recent --set --name shlimit -A shlimit -m recent --update --hitcount 4 --seconds 60 --name shlimit -j DROP -A INPUT -p tcp --dport 22 -m state --state NEW -j shlimit -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -i br1 -j ACCEPT -A INPUT -p udp --sport 67 --dport 68 -j ACCEPT :FORWARD DROP [0:0] -A FORWARD -m account --aaddr 172.16.2.0/255.255.255.0 --aname lan -A FORWARD -m account --aaddr 192.168.2.0/255.255.255.0 --aname lan1 -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -i br1 -o br1 -j ACCEPT -A FORWARD -m state --state INVALID -j DROP -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu :wanin - [0:0] :wanout - [0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i br0 -o br1 -j DROP -A FORWARD -i br1 -o br0 -j DROP -A FORWARD -i vlan2 -j wanin -A FORWARD -o vlan2 -j wanout -A FORWARD -i br0 -j ACCEPT -A FORWARD -i br1 -j ACCEPT -A wanin -p tcp -m tcp -d 172.16.2.103 --dport 21 -j ACCEPT COMMIT ************