Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two networks that I'd like to connect with a router/firewall to filter traffic between the two. One network is on a public subnet, let's say 64.22.12.192/27 and the other network is on a private subnet 192.168.0.0/24. The are connected via a router which has three Ethernet ports, one connected to the internet, the other two connected to the public and private subnets and are on their own VLANS. How do I make the private subnet visible to the public network? Here's the network diagram:

  • Router1 >eth0 --- Connected to Internet
  • Router1 >eth1 --- 64.22.12.193/27 Connected to VLAN 64 Subnet 64.22.12.193/27
  • Router1 >eth3 --- 192.168.0.1/24 Connected to VLAN 192 Subnet 192.168.0.0/24

I tried static routing 192.168.0.0/24 to 64.22.12.193 on the router I also tried routing it to 192.168.0.1. Neither worked.

I want traffic between the two subnets to pass through the router because I want to be able to setup firewall rules on the router between the subnets.

  1. I tried static routes but couldn't get it to work, am I doing something wrong?

  2. I realize I could use NATing but in order to access individual private IP machines, I would have to set up a one-to-one NAT which would eat up my precious limited public IPs

  3. Do I have to setup a Tunnel to accomplish this? Wouldn't a tunnel bypass the firewall rules?

IP route show:

default via 66.22.32.137 dev eth0  proto zebra 
192.168.0.0/24 dev eth3  proto kernel  scope link  src 192.168.0.1
64.22.12.192/27 dev eth1  proto kernel  scope link  src 64.22.12.193
66.22.32.136/29 dev eth0  proto kernel  scope link  src 66.22.32.141
127.0.0.0/8 dev lo  proto kernel  scope link  src 127.0.0.1 
share|improve this question
    
1. What make/model of router? 2. Can you post the roting table from the router? 3. You shouldn't have to manually do anything to get the traffic routed between the internal subnets as the router has an interface directly connected to both internal sunets, just as you shouldn't have to manually do anything to get trafiic routed between each of the internal subnets and the external subnet. 4. Do the hosts on each internal subnet have the router as their DG, using the appropriate ip address of the respective router interface? –  joeqwerty Sep 24 '12 at 23:11
    
Based on your text, I would guess you're using a Linux box as your router/firewall. Please post the routing table (route -n) and your firewall rules (iptables -nvL). –  Michael Hampton Sep 24 '12 at 23:15
    
I'm using vyatta for router/firewall, I updated it with the ip route show output –  Stallionz Sep 24 '12 at 23:22
    
I should comment that I can ping the port on the other end just fine. From 64.22.12.195 I can ping 192.168.0.1 just fine. –  Stallionz Sep 24 '12 at 23:28
    
What do the hosts on 64.22.12.192/27, and 66.22.32.136/29 have as the default gateway? Are they pointed at the Linux box, or something else? –  Zoredache Sep 24 '12 at 23:29

1 Answer 1

up vote 2 down vote accepted

I tried static routes but couldn't get it to work

You shouldn't need static routes, your system already has all the routes it should need. Linux automatically configures routes for every network that is locally attached. Assuming you have ip_forward enabled, and no firewall rules in place currently blocking traffic, everything should just work.

Do I have to setup a Tunnel to accomplish this?

No, you shouldn't need any tunnels.

I realize I could use NATing but in order to access individual private IP machines,

You shouldn't need any NAT rules. In fact if you already have an overly-broad SNAT/MASQ setup that might be your problem.

Assuming all the clients on 64.22.12.192/27 and 192.168.0.0/24 are using your linux box as the their default gateway, and you don't have any SNAT/MASQ rules setup to change the source address of traffic going from eth3 -> eth1 communication should just work.

share|improve this answer
    
Indeed I didn't think I needed the static routes but tried it when I couldn't get it to work. The problem turned out to be the machine I was trying to ping, I can ping other machines just fine. I removed the static routing –  Stallionz Sep 24 '12 at 23:58
    
What do you mean by overly-broad? I need the 192.168.0.0/24 subnet to be able to access the internet, don't I need the masquerading for it? Or do you simply mean I should limit the ports on the NAT (I was going to do that with the firewall anyways) –  Stallionz Sep 24 '12 at 23:59
    
I mean if you added a rule like iptables -s 192.168.0.0/24 -j MASQ then your system would NAT traffic from the private subnet when it accesses the 64.22.12.192/27. You would probably want to an additional condition that limits the MASQ/SNAT so that it only applies when it is leaving the eth0 interface. Something like iptables -s 192.168.0.0/24 -o eth0 -j MASQ perhaps. –  Zoredache Sep 25 '12 at 0:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.