Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm putting a new router on our network to help manage our private network connections and to better control routing to the outside. I've decided to simplify this question by removing references to a second private network on our router (but please be aware that there are reasons for this question so the answer is not to leave the old router the default gateway).

I have the following routing in my iptables on our router:

# Allow established connections, and those !not! coming from the public interface
# eth0 = public interface
# eth1 = private interface #1 (129.2.2.0/25)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the private interface
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade (NAT)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward any other traffic from the public to the private
iptables -A FORWARD -i eth0 -o eth1 -j REJECT

This configuration means that users will be forwarded through a modem/router that has a public address - this is all well and good for most purposes, and in the main it doesn't matter that all computers are hidden behind the one public IP.

However, some users need to be able to access a proxy at 192.111.222.111:8080 - and the proxy needs to identify this traffic as coming through a gateway at 129.2.2.126 (the old router) - it won't respond otherwise.

I tried adding a static route on our router with:

route add -host 192.111.222.111 gw 129.2.2.126 dev eth1

I can successfully ping 192.111.222.111 from the router. When I trace the route, it lists the 129.2.2.126 gateway, but I just get * on each of the following hops (I think this makes sense since this is just a web-proxy and requires authentication).

When I try to ping this address from a host on the 129.2.2.0/25 network it fails.

Should I do this in the iptables chain instead? How would I configure this routing?

Network diagram

enter image description here

Here is the interfaces configuration for the router:

auto eth0
iface eth0 inet static
    address     150.1.2.2
    netmask     255.255.255.248
    gateway     150.2.2.1

auto eth1
iface eth1 inet static
    address     129.2.2.125
    netmask     255.255.255.128

And here is the routing table (without my static route added):

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         eth1202.sa.adsl 0.0.0.0         UG    100    0        0 eth0
localnet        *               255.255.255.0   U     0      0        0 eth1
129.2.2.0       *               255.255.255.128 U     0      0        0 eth1

To restate - I want traffic from 129.2.2.7 (for example) to now route through our router (129.2.2.125). But this router needs to then forward 8080 requests with the destination of 192.111.222.111 - which is somewhere the other side of the old router (129.2.2.126 - which is not manageable by us).

share|improve this question
    
could you provide the routing tables (ip route) and the output of ifconfig as well? There is some confusion about how routes and interfaces are configured in your case - the numbers do not quite match up with the drawing you've posted. –  syneticon-dj Sep 21 '12 at 8:21
    
maybe there's something I'm not getting with the idea of static routes - when I configure the static route on the client (10.2.2.7) it works fine... I thought that this would just be the same on the router? –  HorusKol Sep 23 '12 at 23:36
    
Finally it makes sense, thanks for updating. –  syneticon-dj Sep 24 '12 at 14:59
add comment

2 Answers

up vote 2 down vote accepted

What you are attempting to do is entirely possible and indeed is a quite often used technique. You also have got most of the setup right already. What you might be missing is an "ACCEPT" rule at "new router" allowing traffic flows from eth1 to eth1. Just add it using

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -j ACCEPT

It should be sufficiently safe not to circumvent any of the rules and security measures in place and yet be generic enough to allow any of your network's clients and protocols. Once you've done setting up and troubleshooting, you could restrict the rule to the protocols and destinations you are going to use:

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -d 192.111.222.111 -p icmp -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -s 192.111.222.111 -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -d 192.111.222.111 -p tcp --dport 8080 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -s 192.111.222.111 -p tcp --sport 8080 ! --syn -j ACCEPT

Note that in the typical case, you hardly would see any traffic flow through the "new router" for 192.111.222.111. Linux happily would issue ICMP redirect messages informing your subnet's hosts to use "old router" for traffic to 192.111.222.111 at the first packet occurrence. And most hosts would follow (assuming they got the message - i.e. it has not been filtered anywhere) and send all subsequent packets to 192.111.222.111 directly via "old router".

share|improve this answer
    
in hindsight, this really does make sense... thanks a lot –  HorusKol Sep 25 '12 at 0:56
add comment

If you're routing to a specific host, I don't think that using netmask is correct. Specifying 0.0.0.0 would imply a default gateway for all traffic since that mask would match ALL IPv4 IPs.

In fact, a full 255.255.255.255 is kind of necessary for a single host matching rule.

And perhaps it is obvious, but you must specify a gateway that is on a directly-connected network covered by your existing routing table.

In working with iptables and routing, I'd suggest setting up a LOG rule to send dropped packets to a log. That will tell you if you're dropping packets that might only appear to be routing problem.

This sets up a LOGDROP chain.

-A LOGDROP -j LOG --log-prefix "LOGDROP "
-A LOGDROP -j DROP

And then at the end of various chains that you want to log, you jump to the LOGDROP chain at the end:

-A INPUT -j LOGDROP

Instead of simply dropping the packets. Various LOGDROP chains with different labels will allow you to get more granularity in understanding what you're seeing.

share|improve this answer
    
When I specify a netmask of 255.255.255.255 I get the message that it isn't compatible with the route - probably because the proxy (192) isn't on the same network as the gateway (129) I want to route through –  HorusKol Sep 21 '12 at 1:42
    
If you're specifying -host, I'm not sure why you'd even want to specify mask. Have you tried simply leaving the mask off? –  Magellan Sep 21 '12 at 1:44
    
yeah - but the same results –  HorusKol Sep 21 '12 at 1:48
    
Honestly, your partial IP obfuscation is making this more difficult. So IS that desired gateway on a connected network or not? I'm pretty sure you can't route packets to gateways that aren't on a directly-connected network unless it's going through the default gateway. –  Magellan Sep 21 '12 at 1:53
    
The gateway at 129.n.n.126 is provided to us along with the whole subnet - we don't have control over it. I guess that there is some routing somewhere in the supernet that that gateway connects to which allows users to access the proxy - the problem is, all outgoing traffic on my new gateway at 129.n.n.125 is now routed through a completely different provider - this is what I want, except for this one specific address - so I need to forward requests for 192.n.n.n through 129.n.n.125 to 129.n.n.126 and let that supernet worry about the rest. –  HorusKol Sep 21 '12 at 2:06
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.