Not Able to access web pages

Hi,

I am kinda new  in Nocat.
I am implementing nocat in a SUSE 8 Linux. This Nocat server is also going 
to be the DHCP & DNS Server for the network.
The NOcat Server has a dual network interface. One connecting to our office 
LAN(172.16.x.x) accessing the internet & the other connect to the private 
LAN(192.168.x.x) which we are going to use for the NoCat clients, where i 
have connected one windows machine instead of a access point.

after installing & running Nocat, i get the following problems:

1)The Nocat Clients(Windows machine) are not able to get a webpage.
2) They are not able to ping any FQDN machines, although they are able to do 
NSLOOKUP.
3) the NOcat server is going online & acessing web pages.

we do have a office LAN firewall which assigns a routables IP address to the 
Nocat address.

I tried running ethereal & i am getting checksum errors for TCP & ICMP 
packets , although DNS packets are going fine.

i am sending my IPtable & Nocat.conf.
Thanks for the help.



Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
NoCat      all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain NoCat (1 references)
target     prot opt source               destination
NoCat_Ports  all  --  anywhere             anywhere
NoCat_Inbound  all  --  anywhere             anywhere
ACCEPT     all  --  192.168.1.0/24       anywhere           MARK match 0x1
ACCEPT     all  --  192.168.1.0/24       anywhere           MARK match 0x2
ACCEPT     all  --  192.168.1.0/24       anywhere           MARK match 0x3
ACCEPT     tcp  --  192.168.1.0/24       Nocat.wireless.bhmi.comtcp dpt:http
ACCEPT     tcp  --  Nocat.wireless.bhmi.com  192.168.1.0/24     tcp spt:http
ACCEPT     tcp  --  192.168.1.0/24       Nocat.wireless.bhmi.comtcp 
dpt:https
ACCEPT     tcp  --  Nocat.wireless.bhmi.com  192.168.1.0/24     tcp 
spt:https
ACCEPT     all  --  Nocat.wireless.bhmi.com  192.168.1.0/24
ACCEPT     tcp  --  192.168.1.0/24       Nocat.wireless.bhmi.comtcp 
dpt:domain
ACCEPT     udp  --  192.168.1.0/24       Nocat.wireless.bhmi.comudp 
dpt:domain
DROP       tcp  -- !Nocat.wireless.bhmi.com  anywhere           tcp dpt:5280
DROP       all  --  anywhere             anywhere


**************the Nocat.conf file **************
###### gateway.conf -- NoCatAuth Gateway Configuration.
#
# Format of this file is: <Directive> <Value>, one per
#   line. Trailing and leading whitespace is ignored. Any
#   line beginning with a punctuation character is assumed to
#   be a comment.

###### General settings.
#
# See the bottom of this file for options for logging to syslog.
#
# Log verbosity -- 0 is (almost) no logging. 10 is log
#   everything. 5 is probably a safe middle road.
#
Verbosity       10

##### Gateway application settings.
#
# GatewayName -- The name of this gateway, to be optionally displayed
#   on the splash and status pages. Any short string of text will do.
#
GatewayName	the NoCat Network

##
#
# GatewayMode -- Determines the mode of operation of the gateway. Possible
#   values are:
#
#   Captive	- Allow authentication against an auth service. LEGACY.
#   Passive	- Like Captive, but YOU MUST USE THIS if your gateway
#                   is behind a NAT. Will work anyway if not. *RECOMMENDED*.
#   Open	- Simply require a user to view a splash page and accept
#		    a use agreement.
#
# If Captive or Passive Mode is set, you will need to have values set for
#   AuthServiceAddr, AuthServiceURL, and LogoutURL. You will want to leave a
#   short value for LoginTimeout (probably <600).
#
# If Open Mode is set, you will need to have values set for SplashForm,
#   HomePage, and possibly DocumentRoot (or provide an absolute path for
#   SplashForm).  Also, you will want to set a large value for LoginTimeout
#   (probably >3600).
#
GatewayMode	Passive

##
# GatewayLog -- Optional.  If unset, messages will go to STDERR.
#
GatewayLog	/usr/local/nocat/gw/nocat.log

##
# LoginTimeout - Number of seconds after a client's last
#   login/renewal to terminate their connection. Probably
#   don't want to set this to less than 60 or a lot of
#   bandwidth is likely to get consumed by the client's
#   renewal attempts. Defaults to 300 seconds.
#
# For Captive Mode, you want to set this to something
#   fairly short (like 10 minutes) to prevent connection
#   spoofing.
#
LoginTimeout	36000

# For Open Mode portals, you probably want to comment out
#   the preceding and set LoginTimeout to
#   something large (like 86400, for one notification
#   per day).
#
#LoginTimeout	86400

###### Open Portal settings.
#
##
# HomePage -- The authservice's notion of a default
#   redirect.
#
#HomePage	http://nocat.wireless.bhmi.com/

HomePage       http://192.168.1.1/cgi-bin/login

# DocumentRoot -- Where all of the application templates (including
#   SplashPage) are hiding. Can be different from Apache's DocumentRoot.
#
DocumentRoot	/usr/local/nocat/gw/htdocs

# SplashForm -- Form displayed to users on capture.
#
SplashForm	splash.html

# StatusForm -- Page displaying status of logged in users.
#
StatusForm	status.html


###### Active/Passive Portal settings.
#
##
# TrustedGroups - A list of groups registered with the auth server
#   that a user may claim membership in order to gain Member-class
#   access through this portal. The default magic value "Any" indicates
#   that a member of *any* group is granted member-class access from
#   this gateway.
#
# TrustedGroups	NoCat NYCWireless PersonalTelco
#
TrustedGroups Any

##
# Owners - Optional.  List all local "owner" class users here, separated
#   by spaces.  Owners typically get full bandwidth, and unrestricted
#   access to all network resources.
#
# Owners [email protected] [email protected]

##
# AuthServiceAddr - Required, for captive mode. Must be set to the address 
of
#   your authentication service. You must use an IP address
#   if DNS resolution isn't available at gateway startup.
#
AuthServiceAddr 192.168.1.1
#
#AuthServiceAddr	nocat.wireless.bhmi.com

##
# AuthServiceURL - HTTPS URL to the login script at the authservice.
#
AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login

##
# LogoutURL - HTTP URL to redirect user after logout.
#
LogoutURL	https://$AuthServiceAddr/logout.html

### Network Topology
#
# ExternalDevice - Required if and only if NoCatAuth can't figure it out
#   from looking at your routing tables and picking the interface
#   that carries the default route. Must be set to the interface
#   connected to the Internet. Usually 'eth0' or 'eth1'
#   under Linux, or maybe even 'ppp0' if you're running
#   PPP or PPPoE.
#
ExternalDevice	eth0

##
# InternalDevice - Required if and only if you have ethernet devices
#   on your gateway besides your wireless device and your 'Net connection.
#   Must be set to the interface connected to your local network, normally
#   your wireless card. In Linux, some wireless devices are named 'wvlan0'
#   or 'wlan0' rather than 'ethX'.
#
InternalDevice	eth1

##
# LocalNetwork - Required if and only if NoCatAuth can't figure out
#   the network address of your local (probably wireless) network,
#   given your InternalDevice(s). Must be set to the network
#   address and net mask of your internal network. You
#   can use the number of bits in the netmask (e.g. /16, /24, etc.)
#   or the full x.x.x.x specification.
#
LocalNetwork	192.168.1.0/24

##
# DNSAddr - Optional. *If* you choose not to run DNS on your internal 
network,
#   specify the address(es) of one or more domain name server on the 
Internet
#   that wireless clients can use to get out. Should be the same DNS that 
your
#   DHCP server hands out. If left blank, NoCatAuth will presume that you
#   want to use whatever nameservers are listed in /etc/resolv.conf.
#
# DNSAddr 172.16.1.248

##
# AllowedWebHosts - Optional.  List any domains that you would like to
#   allow web access (TCP port 80 and 443) BEFORE logging in (this is the
#   pre-'skip' stage, so be careful about what you allow.)
#
# AllowedWebHosts	nocat.net

##
# RouteOnly - Required only if you DO NOT want your gateway to act as a NAT.
#   Uncomment this only if you're running a strictly routed network, and
#   don't need the gateway to enable NAT for you.
#
# RouteOnly	1

##
# IgnoreMAC - Set this if and only if the NoCat gateway isn't directly
#   connected (or bridged at Layer 2) to your internal (usually wireless)
#   network. In that event, the gateway won't be able to match clients based
#   on MAC address, and will fall back to using IPs only. This is
#   theoretically less secure, as IP addresses are usually easier to spoof
#   than MAC addresses, so don't use this unless you know what you're doing.
#
# IgnoreMAC	1

##
# MembersOnly - Optional.  Uncomment this if you want to disable public
#   access (i.e. unauthenticated 'skip' button access).  You'll also want to
#   point AuthServiceURL somewhere that doesn't include a skip button (like
#   at your own Auth server.)
#
# MembersOnly	1

##
# IncludePorts - Optional.  Specify TCP ports to allow access to when
#   public class users login.  All others will be denied.
#
#   For a list of common services and their respective port numbers, see
#   your /etc/services file. Depending on your firewall, you might even
#   be able to specify said services here, instead of using port numbers.
#
# IncludePorts    22 80 443

##
# ExcludePorts - Optional.  Specify TCP ports to denied access to when
#   public class users login.  All others will be allowed.
#
#   Note that you should use either IncludePorts or ExcludePorts, but not
#   both.  If neither is specified, access is granted to all ports to
#   public class users.
#
#   You should *always* exclude port 25, unless you want to run an portal
#   for wanton spam sending. Users should have their own way of sending
#   mail. It sucks, but that's the way it is. Comment this out *only if*
#   you're using IncludePorts instead.
#
# ExcludePorts 23 25 111
#
#ExcludePorts    25

####### Syslog Options -- alter these only if you want NoCat to log to the
#        system log!
#
# Log Facility - syslog or internal.  Internal sends log messages
#    using the GatewayLog or STDERR if GatewayLog is unset.  Syslog
#    sends all messages to the system log.
#
# LogFacility	internal

##
# SyslogSocket - inet or unix.  Inet connects to an inet socket returned
#    by getsrvbyname().  Unix connects to a unix domain socket returned by
#    _PATH_LOG in syslog.ph (typically /dev/log).  Defaults to unix.
#
# SyslogSocket unix

##
# SyslogOptions - Zero or more of the words pid, ndelay, cons, nowait
#    Defaults to "cons,pid".
#
# SyslogOptions cons,pid

##
# SyslogPriority - The syslog class of message to use:  In decreasing 
importance,
#    the typical priorities are EMERG, ALERT, CRIT, ERR, WARNING, NOTICE, 
INFO,
#    and DEBUG.  Defaults to INFO.
#
# SyslogPriority INFO

##
# SyslogFacility - The facility used to log messages.  Defaults to user.
# SyslogFacility user

##
# SyslogIdent - The ident of the program that is calling syslog.  This will
#    be prepended to every log entry made by NoCat.  Defaults to NoCat.
#
# SyslogIdent NoCat

###### Other Common Gateway Options. (stuff you probably won't have to 
change)
#
# ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset,
#   open and close the firewall. You probably don't need to
#   change these.
#
# ResetCmd	initialize.fw
# PermitCmd	access.fw permit $MAC $IP $Class
# DenyCmd	access.fw deny $MAC $IP $Class

##
# GatewayPort - The TCP port to bind the gateway
#   service to. 5280 is de-facto standard for NoCatAuth.
#   Change this only if you absolutely need to.
#
# GatewayPort     5280

##
# PGPKeyPath -- The directory in which PGP keys are stored.
#   NoCat tries to find this in the pgp/ directory above
#   the bin/ parent directory. Set this only if you put it
#   somewhere that NoCat doesn't expect.
#
PGPKeyPath	/usr/local/nocat/gw/pgp

##
# MessageVerify -- Shell command to verify a PGP signed
#   message. The actual message is delivered to the
#   command's standard input. NoCat tries to find gpg
#   and gpgv in your path. Set these only if you need to find
#   them elsewhere.
#
# GpgvPath	/usr/bin/gpgv
#
# MessageVerify	$GpgvPath --homedir=$PGPKeyPath 2>/dev/null

##
#
# IdleTimeout -- How often to check the ARP cache, in seconds,
#   for expiration of idle clients.
#
# MaxMissedARP -- How many times a client can be missing from
#   the ARP cache before we assume they've gone away, and log them
#   out. Set to 0 to disable logout based on ARP cache expiration.
#
#MaxMissedARP	2
#
IdleTimeout   300

### Fin!







Karthikeyan Ragunathan
System Administrator
Baldwin Hackett & Meeks Inc.
Omaha, NE.
USA