1

Currently the LAN I manage is organized as follows: internal network (192.168.1.0) which uses a Linux server as a gateway (internal address on interface br0 192.168.1.1, external address on interface br1 10.0.0.2) through NAT; then the 10.0.0.0 network has another gateway (10.0.0.1) which through another NAT connects the whole thing to the internet. What I would like to achieve is to configure the Linux server so that the first layer of NAT is no more necessary, so that for example a computer in the 10.0.0.0 network can ping every computer in the 192.168.1.0 network. I deleted this iptables rule: iptables -t nat -A POSTROUTING -o br1 -j SNAT --to-source 10.0.0.2, but of course now computers on 192.168.1.0 cannot reach the internet; ip forwarding is of course enabled. What's missing here? Thanks

2 Answers 2

4

You would need to add a route to the 192.168.1.0 network on the external gateway because it has no idea how to reach it.

4
  • Another way is to make ethernet bridge from linux box. Then all computers will have addresses from 10.0.0.0/8
    – gelraen
    Feb 26, 2011 at 13:08
  • That is possible but, depending on the goal of the action, might be entirely undesirable.
    – Sven
    Feb 26, 2011 at 13:11
  • Unfortunately bridging is not an option, since it is already used for other things and it would result in a mess. I'm not sure adding a route on the external gateway would be enough: currently (with just nat disabled) 192.168.1.0 computers cannot even ping the external gateway.
    – Alberto
    Feb 26, 2011 at 13:28
  • 1
    Of course they can't because the external gateway doesn't know how to answer a ping without a route to that network.
    – Sven
    Feb 26, 2011 at 13:35
0

You have removed the NAT on the server, but have the clients connected to it changed their IP address? They might still have 192.168.1.0/24 addresses. Each client under the first part of the network needs to either reconfigure their IP settings or (if using DHCP) send a new DHCPOFFER to receive a new IP address.

You may have already done this, but I wanted to check.

2
  • I don't think he wants to get rid of the 192.168 net altogether, just remove the need for NAT.
    – Sven
    Feb 26, 2011 at 13:01
  • The idea was to keep 192.168.1.0, but removing it is feasible if it doesn't involve bridges (the server is alreadly using bridges to merge wired and wireless networks and that would become a mess).
    – Alberto
    Feb 26, 2011 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .