Need help with separating two internal interfaces.

[tektest]

Hi.
After reinstalling my server with ebox 1.4 I m having trouble setting it up.
Interface layout:
eth0: 192.168.1.100 - External interface for WAN
eth1: 192.168.2.100 - Internal interface for employee use
eth2: 10.1.0.1 - Internal interface for guest use

I am having trouble separating eth1 and eth2. Since when I m on 10.1.0.X network I am able to ping and to access the https://192.168.2.100 admin panel.

Does any one have any ideas on the firewall adjustments that need to be added to fix this?
Thanks in advance.

[lelik]

You are able to ping and to access 192.168.2.100 simply because you have one computer (ebox) with 3 NICs. You will not be able to ping or access any computer on 192.168.2.0/24 network except ebox itself.

eth0: 192.168.1.100,  - External interface for WAN?

192.168.0.0 – 192.168.255.255 is assigned to the private network and it's not routable. You need a DHCP or a static ip from your ISP.

[tektest]

You are able to ping and to access 192.168.2.100 simply because you have one computer (ebox) with 3 NICs. You will not be able to ping or access any computer on 192.168.2.0/24 network except ebox itself.

eth0: 192.168.1.100,  - External interface for WAN?

192.168.0.0 – 192.168.255.255 is assigned to the private network and it's not routable. You need a DHCP or a static ip from your ISP.

I am connected to the eth1 network with my computer my ip is 192.168.2.15
And my problem is that I am ABLE to connect to a router on 10.1.0.200
What I need is to separate these two networks so the server blocks any connections from 192.168 (eth1) to 10.1 (eth2) network.
Regarding eth0 it is connected to a DSL modem, thats why it has a 192.168.1.100 address on eth0

I ve tried checking the IPTABLES and here is what I got out of it:

Chain premodules (1 references)
 pkts bytes target     prot opt in     out     source               destination
  377 18096 REDIRECT   tcp  --  eth1   *       0.0.0.0/0           !192.168.2.100       tcp dpt:80 redir ports 3129
  226 14176 REDIRECT   tcp  --  eth2   *       0.0.0.0/0           !10.1.0.1            tcp dpt:80 redir ports 3129

This is what seems to be making the problem, but I m not sure how to fix this.

[lelik]

Still do not understand what you are trying to achieve. You will be able to connect to ebox no matter what as it's the same computer with 3 NIC interfaces. Having said that, you will not be able to access computers from one subset to the other. Computers on 10.0.1.0/24 will not be able to "see" computers on 192.168.2.0/24 and vise verse.

[tektest]

You will not be able to access computers from one subset to the other. Computers on 10.0.1.0/24 will not be able to "see" computers on 192.168.2.0/24 and vise verse.

This is exactly what I am trying to achieve.
The thing is that I am trying to separate the Employee network from the guest network (I m tryin to block the guests out of the Office network).

Sorry for being unclear.

[lelik]

They are already separated by design. No extra configuration required.

[tektest]

Thats the way it worked on ebox 1.2 but after installing a clean version of 1.4 this doesn't seem to be the case. I guess I can try reinstalling.

[Saturn2888]

Still do not understand what you are trying to achieve. You will be able to connect to ebox no matter what as it's the same computer with 3 NIC interfaces. Having said that, you will not be able to access computers from one subset to the other. Computers on 10.0.1.0/24 will not be able to "see" computers on 192.168.2.0/24 and vise verse.

I can. I can have people from 1.1.0.0 ping 2.2.2.0; although, both machines are on the same physical hardware in my case, and it's setup as a virtual interface instead of an actual card. Still, they're able to interact even when in differing subnets because, by default, eBox has no method of controlling routes between subnets. It'd be really nice if there was a way to control which subnets have access to other subnets.

For me, this changed after moving to eBox 1.2 I think as I remember being unable to ping outside of my subnet (not External interface) before in 1.0 and 1.1. Since the 1.2 upgrade I lost that ability as routes were dynamically created. Not a big deal so much anymore as I've password-locked everything now.

[tektest]

This must have been a bug.
I ve just reinstalled ebox from zero and it automatically separated the internal interfaces from each other, so everything works fine.
Thanks for your help.