0

The setup:

Debian; acting as the network's router using iptables, fail2ban Because of external requirements, both networks are 192.168.1.x. eth0: 192.168.1.1 eth1: 192.168.1.2

Ubuntu (192.168.1.3) acting as a network bridge of sorts eth0: 192.168.1.3 wlan0: 192.168.1.10

Client computers (192.168.1.100 through 200) connected to a switch

Debian's eth0(192.168.1.1) on my internal network, connects to a switch along with the Client computers, a mixture of desktop computers, wireless devices, etc.

eth1 is connected directly to Ubuntu's eth0.

I can ping and ssh to Ubuntu from Debian without a problem. When I try to ping or SSH from one of the client computers (connected to Debian's eth0), my connections time out.

I'm not sure if I should use route (or fully sure how to use route, for that matter) or iptables to get traffic from Debian's eth0 to eth1 and on to Ubuntu.

Here is my iptables output:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state NEW

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth2   eth0    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  eth1   eth1    0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Would appreciate any help. Thanks!

2
  • Please provide the output of sudo iptables-save |grep -v ^# and feel free to pipe this further through sed or so to disguise the actual IPs in question in case they're public IPs. Mar 31, 2013 at 19:39
  • Use a GRE Tunnel.
    – Jacob
    Mar 31, 2013 at 21:17

1 Answer 1

1

Have you bridged the interfaces on the debian box? If not, what interface has the ip address 192.168.1.2. What ip address does the OTHER interface on your debian box have? Please add this information in the question.

As the question is not complete, I can only "guess" that the routing table on your Debian gets mixed up, because you have assigned same ip network addresses (or even same ip address) to the 2 non bridged interfaces of the debian box.

if that is indeed the problem, You should alter the ip network on the ubuntu - debian connection to some different Class C network. Say 192.168.2. / 255.255.255.0, so debian eth1 would have 192.168.2.3 and ubuntu would get 192.168.2.4.

Then you should be able to access the ubuntu box from your clients by typing ssh [email protected], even though all your clients would be in the 192.168.1.xxx/255.255.255.0 ip network.

3
  • Thank you. I was able to modify the network between Debian and Ubuntu. I changed their eth1 and eth0, respectively, to 192.168.0.1 and 192.168.0.3. I can now SSH from Debian and all of the Client computers. Provided there were no duplicate IP addresses, would there be a way to to make this work while leaving both networks set to 192.168.1.x? Would it only require more precise iptables rules? Mar 31, 2013 at 23:50
  • @Noonien2600 It can be done but requires marking packets and then altering the routing table to send marked packets down a specific interface. I have never tried because it seems more error prone and a headache. You can type route -n or ip route to have the kernel print out its routing table. Once you understand how to read the table link you will see that the kernel will only choose one of the 2 interfaces to route the 192.168.1. ip network packets.
    – nass
    Apr 1, 2013 at 8:12
  • @Noonien2600 (continuing from above) To Avert the problem without using 2 ip networks, you can either bridge the 2 interfaces on the debian box (effectively making them one), or you can simply connect the ubuntu box directly to the switch. But I take it you want to separate the ubuntu box from the vast majority of the clients, so the 2 ip networks solution is the way forward.
    – nass
    Apr 1, 2013 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .