Re: setting up nocatauth on a linux bridge

I try to explain better my situation:

I got three machines slackgw1, slackbr1 and slackcl1 and 
they're connected like this:

(internet) <--> (slackgw1) <--> (slackbr1) <--> (slackcl1)
                eth1     eth0   eth0     eth1   eth0 

slackgw has eth1 connected to a router and is a gateway 
itself: eth1 has address 192.168.200.2 and eth0 
192.168.201.1
slackbr1 is a bridge with eth0 and eth1 bridged as br0 
that has address 192.168.201.5 (and is the machine running 
the authservice and 
the gateway of NoCatAuth)
slackcl1 is a client with eth0 192.168.201.102

this is my bridge script:

ifconfig eth0 down
ifconfig eth1 down
ifconfig eth0 0.0.0.0 up
ifconfig eth1 0.0.0.0 up
brctl addbr br0
brctl stp br0 off
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 192.168.201.5 netmask 255.255.255.0 up
route add default gw 192.168.201.1

(and it works ok ;) ) Then I installed nocat following 
instructions on samemachine.txt and I started customizing 
the scripts for the b
ridge.

these are the lines that I changed in the initialize.fw 
script:
(uncommented this)
             $fwd -o $iface -d $net -m mark --mark $fwmark 
-j ACCEPT
(commented these others)
#    echo "1" > /proc/sys/net/ipv4/ip_forward
#           $nat -o $ExternalDevice -s $net -m mark --mark 
$fwmark -j MASQUERADE
#                   $nat      -s $net -d $host -p tcp 
--dport $port -j MASQUERADE
#           $nat -p $prot -s $net -d $dns --dport 53 -j 
MASQUERADE

these are the lines I changed from the default in the 
nocat.conf of the gateway:

HomePage        http://192.168.201.5/
AuthServiceAddr 192.168.201.5
ExternalDevice  br0
InternalDevice  br0
DNSAddr 131.114.28.5
RouteOnly       1
MembersOnly     1

these are the lines I changed from the default in the 
nocat.conf of the authserv:

HomePage        http://192.168.201.5/
DataSource      Passwd
LocalGateway    192.168.201.5

from slackbr1 I can ping the other two.
I start apache ancd then the gateway.
these are the resulting iptables rules after starting the 
gateway:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
NoCat      all  --  anywhere             anywhere

Chain NoCat (1 references)
target     prot opt source               destination
NoCat_Ports  all  --  anywhere             anywhere
NoCat_Inbound  all  --  anywhere             anywhere
ACCEPT     all  --  192.168.201.0/24     anywhere 
           MARK match 0x1
ACCEPT     all  --  anywhere             192.168.201.0/24 
   MARK match 0x1
ACCEPT     all  --  192.168.201.0/24     anywhere 
           MARK match 0x2
ACCEPT     all  --  anywhere             192.168.201.0/24 
   MARK match 0x2
ACCEPT     tcp  --  192.168.201.0/24 
    slackbr1.pippo.net  tcp dpt:http
ACCEPT     tcp  --  slackbr1.pippo.net   192.168.201.0/24 
   tcp spt:http
ACCEPT     tcp  --  192.168.201.0/24 
    slackbr1.pippo.net  tcp dpt:https
ACCEPT     tcp  --  slackbr1.pippo.net   192.168.201.0/24 
   tcp spt:https
ACCEPT     all  --  ns.ing.unipi.it      192.168.201.0/24
ACCEPT     tcp  --  192.168.201.0/24     131.114.28.5 
       tcp dpt:domain
ACCEPT     udp  --  192.168.201.0/24     ns.ing.unipi.it 
    udp dpt:domain
DROP       all  --  anywhere             anywhere

Chain NoCat_Inbound (1 references)
target     prot opt source               destination

Chain NoCat_Ports (1 references)
target     prot opt source               destination
DROP       tcp  --  anywhere             anywhere 
           tcp dpt:smtp MARK match 0x3
DROP       udp  --  anywhere             anywhere 
           udp dpt:smtp MARK match 0x3

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I try to connect from slackcl1 to the web server at 
192.168.200.2 (after slackgw1: i can see it from the 
bridge) and I get to the authserv, I authenticate and I 
got in a loop, getting again at the login prompt :(

the only iptables rule added is
ACCEPT     all  --  anywhere 
            slackcl1.pippo.net

I hope it's a little bit clearer :)