Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a linux box that acts as router, DHCP server, and proxy. On my LAN side I need two subnets to have enough IPs: 192.168.100.0 - 192.168.101.255 - is the range I need. Both subnets must be able to reach the internet through my linux box,

On eth1 (em1) I have my internet modem connected with a static IP.

On eth2 (em2) I have my LAN connected with the following settings:

  • IP address: 192.168.100.1
  • Broadcast address: 192.168.101.255
  • Subnet mask: 255.255.254.0
  • Default gateway: 192.168.100.1

My routing table is as follows:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         56343ffe.rev.st 0.0.0.0         UG    0      0        0 em1
86.52.0.0       *               255.255.192.0   U     1      0        0 em1
192.168.100.0   *               255.255.254.0   U     1      0        0 em2
192.168.101.0   *               255.255.255.0   U     0      0        0 em2

All traffic from port 80 is redirected to my proxy in shorewall - and this works fine - all hosts can access websites, YouTube etc. (port 80). All other traffic is masqueraded - but traffic to other ports is a problem - e.g. Microsoft's DRM license server AVG update server - unreachable!? But I believe something is misconfigured in the routing table ?? My firewall accepts all outbound traffic after redirecting port 80 traffic.

Edit - output from my firewall (I have substituted the numbers in the internet address with xxx.xxx):

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
dnat       all  --  anywhere             anywhere

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
em1_masq   all  --  anywhere             anywhere

Chain dnat (1 references)
target     prot opt source               destination
loc_dnat   all  --  anywhere             anywhere

Chain em1_masq (1 references)
target     prot opt source               destination
SNAT       all  --  192.168.100.0/24     anywhere             to:86.52.xxx.xxx
SNAT       all  --  192.168.101.0/24     anywhere             to:86.52.xxx.xxx

Chain loc_dnat (1 references)
target     prot opt source               destination
REDIRECT   tcp  --  192.168.100.0/24     anywhere             multiport dports http,squid redir ports 8080
REDIRECT   tcp  --  192.168.101.0/24     anywhere             multiport dports http,squid redir ports 8080
share|improve this question

migrated from stackoverflow.com Aug 24 '12 at 8:26

This question came from our site for professional and enthusiast programmers.

    
"enought" — whaht? –  poige Aug 24 '12 at 8:31
    
so the linux box is the firewall too? What firewall software are you using? Can you output the firewall rules to add to the question? Are you also asking if the two ip ranges you specify will have 'enough' hosts? –  Paul D'Ambra Aug 24 '12 at 9:01
    
What's this about two subnets? Your question describes only one subnet, 192.168.100.0/23. –  Michael Hampton Aug 24 '12 at 9:12
    
I use shorewall as firewall. I have 510 hosts and that's enough. I thought the problem was that it is two different subnets if you say 192.168.100.x and 192.168.101.x - but I'm new to this :-( –  user1621015 Aug 24 '12 at 10:04

1 Answer 1

You will have to NAT (masquerade) them.
And there you fail.
You say it is masqueraded, but obviously that isn't working.
(Port 80 does work because it gets proxied.)

There is some configuration on the NAT or the firewall (possibly BOTH) not correct.

P.S. You don't need that last routing line. It's already covered by the one above it.

share|improve this answer
    
I have the folowing in the masq file in shorewall (I have substitued the last digits with xxx) INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH # GROUP em1 192.168.100.0/24 86.52.xxx.xxx em1 192.168.101.0/24 86.52.xxx.xxx –  user1621015 Aug 24 '12 at 9:35
    
Doesn't I need some kind of localhost in the routing table ?? 127.0.0.1 ?? –  user1621015 Aug 24 '12 at 10:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.