Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a linux box that acts as router, dhcp-server (and proxy) . On my LAN side i need two subnets to have enough IP's: 192.168.100.0 - 192.168.101.255 - is the range I need. Both subnets must be able to reach the internet through my linux box,

On eth1 (em1) i have my internet modem connected with a static ip

On eth2 (em2) I have my LAN connected with the following settings:

IPv4

IP-address: 192.168.100.1

Broadcast address: 192.168.101.255

Subnet masq: 255.255.254.0

Default gateway: 192.168.100.1

My routing table is as follows:

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface

default 56343ffe.rev.st 0.0.0.0 UG 0 0 0 em1

86.52.0.0 * 255.255.192.0 U 1 0 0 em1

192.168.100.0 * 255.255.254.0 U 1 0 0 em2

192.168.101.0 * 255.255.255.0 U 0 0 0 em2

All traffic from port 80 is redirected to my proxy in shorewall - and this works fine - all hosts can acces websites,youtube etc. (port 80). All other traffic is masqueraded - but traffic to other ports is a problem - eg. microsofts DRM license server AVG update server - unreachable!? But I believe something is misconfigured in the routing table ?? My firewall accepts all outbound traffic after redirecting port 80 traffic.

Thanks in advance for any help !

Edit - ouput from my firewall (i have substituted the numbers in the internet address with xxx.xxx):

Chain PREROUTING (policy ACCEPT) target prot opt source destination dnat all -- anywhere anywhere

Chain INPUT (policy ACCEPT) target prot opt source destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

Chain POSTROUTING (policy ACCEPT) target prot opt source destination em1_masq all -- anywhere anywhere

Chain dnat (1 references) target prot opt source destination loc_dnat all -- anywhere anywhere

Chain em1_masq (1 references) target prot opt source destination SNAT all -- 192.168.100.0/24 anywhere to:86.52.xxx.xxx SNAT all -- 192.168.101.0/24 anywhere to:86.52.xxx.xxx

Chain loc_dnat (1 references) target prot opt source destination REDIRECT tcp -- 192.168.100.0/24 anywhere multiport dports h ttp,squid redir ports 8080 REDIRECT tcp -- 192.168.101.0/24 anywhere multiport dports h ttp,squid redir ports 8080

share|improve this question
"enought" — whaht? – poige Aug 24 '12 at 8:31
so the linux box is the firewall too? What firewall software are you using? Can you output the firewall rules to add to the question? Are you also asking if the two ip ranges you specify will have 'enough' hosts? – Paul D'Ambra Aug 24 '12 at 9:01
What's this about two subnets? Your question describes only one subnet, 192.168.100.0/23. – Michael Hampton Aug 24 '12 at 9:12
I use shorewall as firewall. I have 510 hosts and that's enough. I thought the problem was that it is two different subnets if you say 192.168.100.x and 192.168.101.x - but I'm new to this :-( – user1621015 Aug 24 '12 at 10:04

migrated from stackoverflow.com Aug 24 '12 at 8:26

1 Answer

up vote 1 down vote

You will have to NAT (masquerade) them.
And there you fail.
You say it is masqueraded, but obviously that isn't working.
(Port 80 does work because it gets proxied.)

There is some configuration on the NAT or the firewall (possibly BOTH) not correct.

P.S. You don't need that last routing line. It's already covered by the one above it.

share|improve this answer
I have the folowing in the masq file in shorewall (I have substitued the last digits with xxx) INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH # GROUP em1 192.168.100.0/24 86.52.xxx.xxx em1 192.168.101.0/24 86.52.xxx.xxx – user1621015 Aug 24 '12 at 9:35
Doesn't I need some kind of localhost in the routing table ?? 127.0.0.1 ?? – user1621015 Aug 24 '12 at 10:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.