Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently the LAN I manage is organized as follows: internal network (192.168.1.0) which uses a Linux server as a gateway (internal address on interface br0 192.168.1.1, external address on interface br1 10.0.0.2) through NAT; then the 10.0.0.0 network has another gateway (10.0.0.1) which through another NAT connects the whole thing to the internet. What I would like to achieve is to configure the Linux server so that the first layer of NAT is no more necessary, so that for example a computer in the 10.0.0.0 network can ping every computer in the 192.168.1.0 network. I deleted this iptables rule: iptables -t nat -A POSTROUTING -o br1 -j SNAT --to-source 10.0.0.2, but of course now computers on 192.168.1.0 cannot reach the internet; ip forwarding is of course enabled. What's missing here? Thanks

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You would need to add a route to the 192.168.1.0 network on the external gateway because it has no idea how to reach it.

share|improve this answer
    
Another way is to make ethernet bridge from linux box. Then all computers will have addresses from 10.0.0.0/8 –  gelraen Feb 26 '11 at 13:08
    
That is possible but, depending on the goal of the action, might be entirely undesirable. –  Sven Feb 26 '11 at 13:11
    
Unfortunately bridging is not an option, since it is already used for other things and it would result in a mess. I'm not sure adding a route on the external gateway would be enough: currently (with just nat disabled) 192.168.1.0 computers cannot even ping the external gateway. –  Alberto Feb 26 '11 at 13:28
1  
Of course they can't because the external gateway doesn't know how to answer a ping without a route to that network. –  Sven Feb 26 '11 at 13:35
    
Oh, you're right! Thanks –  Alberto Feb 26 '11 at 13:53

You have removed the NAT on the server, but have the clients connected to it changed their IP address? They might still have 192.168.1.0/24 addresses. Each client under the first part of the network needs to either reconfigure their IP settings or (if using DHCP) send a new DHCPOFFER to receive a new IP address.

You may have already done this, but I wanted to check.

share|improve this answer
    
I don't think he wants to get rid of the 192.168 net altogether, just remove the need for NAT. –  Sven Feb 26 '11 at 13:01
    
The idea was to keep 192.168.1.0, but removing it is feasible if it doesn't involve bridges (the server is alreadly using bridges to merge wired and wireless networks and that would become a mess). –  Alberto Feb 26 '11 at 13:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.