ClearFoundation

My setup runs like this: my adsl connection gets a dynamic ip from my isp, and gives an ip to my external interface. The internal interface gives ip's to the clients on my network. The problem I have is that while web browsing works fine, I cannot ping my router from inside the network. I also cannot see my ClearOS box from outside. I'm missing something here aren't I? I've opened ports but I'm sure the problem is between the router and the ClearOS box.
Any ideas.

HI Youngone
does your router have NAT setup or is it passing the ip address from your ISP to your ClearOS box?
if the router is doing the dialup you will need to move it to your ClearOS box or enable the DMZ func on the router and point it to your clearOS box.

That's actually quite normal...you would need to set your WAN IP to something in the range of your router IP and subnet as traffic has to go past your firewall to get to it from the LAN, and is 'natted' to your WAN IP.

How are you testing external access? opening port 80 for example should show you the default ClearOS webpage

It is also quite possible that your adsl router has a firewall / NAT in which case you are suffering from 'double NAT'. Disable your router firewall as it is no longer required for the ClearOS to function as your gateway device.

You can use this site : creately.com/ to show a diagram of your setup. 1 image says more then 1000 words

Should I set my WAN interface to a static ip then? At the moment it is getting a dynamic ip from the router. If all the interfaces get a static ip in the same range, will I be ok? Obviously I'll have to open ports in the ClearOS firewall. I have turned the router firewall off.
Thanks for your help.

Yes - but only as a temporary measure to access your modem config as you won't be able to access the internet. Normal operation is to use a dynamic IP as you have already

If you want a more permanent solution you would need to look at setting up a static route so that ClearOS knows which interface to send traffic destined to your router IP / subnet (i.e. 192.168.1.x / 255.255.255.0) this would have to be different from your LAN subnet otherwise they would overlap.

Karel De Stomme wrote:
You can use this site : creately.com/ to show a diagram of your setup. 1 image says more then 1000 words

Great link! thanks for that

RFC1918 addresses are not routeable so if your ADSL modem is giving one of these addresses to your ClearOS firewall then you will not be able to get to that firewall unless you port forward from the ADSL box. I've done this before and it works fairly well when I forwarded all the ports from my ADSL box to my ClearOS box. However, the one module that will never work in this situation is the IPSEC module because it will want a public address for all of the interfaces.

To recap, here is a list of all the RFC1918 addresses:

10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

If you external (WAN) address is one of these then you are getting you internet from another NAT device.