Linux as a router between three networks (one is Internet)

Question

I have a Linux box that is routing between two networks X.X.3.0 and X.X.4.0 , I want it to be able to connect these networks to the Internet.

I have read here on the @Kevin's great answer that in order to be able to do so i have to use NAT which means iptables, my server right now doesn't use iptables so I need to find the right command in order to enable that.

my network can be described like this: Internet <-(eth0) Linux Router <-[1](eth1) 192.168.3.0 <--[2](eth2) 192.168.4.0 The eth2 is connected to the Router directly.

The two local networks can talk with each other, but no one can even ping to a public IP address. I have tried to sniff the packets in the Router, when i am issue the ping command to a public IP address on one machine in the .3.x network, but as far as i can tell there is a problem, and it seems to be with an endless ARP requests of the eth0 int about who has the 3.x IP address. It seems that i have to enable on the Router to behave like a NAT too. I have did a search and i couln't figure out the right command that i am need to issue with the iptables, although i have did try the commands that mentioned here and here. I have had to ability to route between the two local networks without using iptables at all, and since i am don't need it i prefer not to use it, unless it's impossibole to do NAT without it (in that case i am prefer iptable that any other program).

to sum up the question: 1. i need to be able that all the three networks would be able to talk to each other. 2. i prefer no use iptables (if that possibole) or any other added program. 3. That's all.

Thanks.

Answer 1

The two local networks can talk to each other means you have ip_forward enabled. If the local networks can not ping public IP address means you need to do masquerading.

Are you able to ping public IP address from this linux box? If no then there must be some other problem. Maybe, you need to setup your router in bridged mode(It's only a guess).

I assume that your linux machine can ping public ip and there is public ip configured on eth0. So your internal network machines can not go outside to the Internet with the private ip address so you need to do natting. Try using iptables because it is pretty much straight forward.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

If you do not have iptables installed on your system. There must be some firewall installed by default. Which distro you are using?

Answer 2

Private IP addresses are not valid for Internet use and can not be routed. They can be used locally only.

To enable Internet access, you need to enable IP forwarding which seems to be done from your description. Second, you need to use NATing. Most of the time, your ISP does the NATing for you. This can change dpending on the connection type and assigned IPs.

For the tool, I dont think there is a better tool than iptables to do it under Linux.

Answer 3

After some research and recommeds from your peopole, i came to conclution that iptable is the best way to do NATing (masqurating), so i did it like the following:

#Flush all of the current iptables settings with:

$>iptables -F and $>iptables -t nat -F

Then try to ping between the local networks, it should work with the defaults of iptables, in case it doesn't type this:

$>iptables -P INPUT ACCEPT

$>iptables -P FORWARD ACCEPT

$>iptables -P OUTPUT ACCEPT

Then issue the command above from @Sachin Divekar (replace the ethX with your interface of the internet connection):

$>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Test, it should work. Then you should save This settings with:

$>iptables-save > /etc/sysconfig/iptables

Done.