Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

EDIT : I've edited the question & the title to bring more clarity hoping that someone will be able to point me in the right direction.

           *************************
           * Internet Modem/Router *    
           *    192.168.1.1        *
           *************************
                     *                   
                     *    
                     *  192.168.1.2(eth0)
           *************************
           *    Linux Firewall     *  
           ************************* 
                    *   192.168.2.1(eth1) , 192.168.3.1(eth1:0) <--- (Virtual Interface)
                    *
                    *
                    *
           *************************       ***********
           *        Switch         * * * * * Router  ********** 192.168.0.x network.
           *************************       ***********
           *                      *         10.0.0.200
           *                      *
           *                      *
           *                      *
           *                      *
         * * * *                * * * *
         * PC  *                * PC  *
         * * * *                * * * *

    IP:192.168.2.10          IP: 192.168.3.10
  Gateway: 192.168.2.1      Gateway: 192.168.3.1  

Gateway's of both the networks i.e 192.168.2.0/24 and 192.168.3.0/24 computers are both residing in the Linux firewall machine namely 192.168.2.1(eth1) , 192.168.3.1(eth1:0 -Virtual Interface).

Note: Computers in 192.168.2.0/24 and 192.168.3.0/24 network are both connected to a single switch.

  1. The computers in the 192.168.2.0/24 network and the computers in the 192.168.3.0/24 network should be able to share files with each other, ping, ssh etc.

  2. Machines from 192.168.2.0/24 or 192.168.3.0/24 accessing machines in 192.168.0.x network, packets of the same should be sent to the router 10.0.0.200.

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

iptables -L Chain INPUT (policy DROP) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere 192.168.1.2 tcp spts:login:65535 dpt:ssh >state NEW,ESTABLISHED ACCEPT tcp -- anywhere 192.168.1.2 tcp spts:login:65535 dpt:ndmp >state NEW,ESTABLISHED ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT) target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- 192.168.1.2 anywhere tcp spt:ssh dpts:login:65535 state ESTABLISHED ACCEPT tcp -- 192.168.1.2 anywhere tcp spt:ndmp dpts:login:65535 state ESTABLISHED ACCEPT all -- anywhere anywhere

Machine: 192.168.2.10

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.10 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.2.0 255.255.255.0 192.168.2.10 192.168.2.10 10
192.168.2.12 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.2.10 192.168.2.10 10
224.0.0.0 240.0.0.0 192.168.2.10 192.168.2.10 10
255.255.255.255 255.255.255.255 192.168.2.10 192.168.2.10 1

Default Gateway: 192.168.2.1

Persistent Routes:
None

Machine: 192.168.3.10

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.10 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.2.0 255.255.255.0 192.168.3.10 192.168.3.10 10
192.168.2.12 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.3.10 192.168.3.10 10
224.0.0.0 240.0.0.0 192.168.3.10 192.168.3.10 10
255.255.255.255 255.255.255.255 192.168.3.10 192.168.3.10 1

Default Gateway: 192.168.3.1

Persistent Routes:
None

For much easier reading the output of the above commands is available at Pastebin here

I've read LARTC but frankly it's intimidating at this point. I am a little short of knowledge/information on where to begin. Any inputs in pointing me in the right direction will help.

share|improve this question
    
Post the output of: sysctl net.ipv4.ip_forward & iptables -L on the linux box, and route print on the two windows guests. –  Aaron Tate Sep 6 '13 at 8:10
    
What have you done so far? –  Michael Hampton Sep 6 '13 at 13:55
    
Output of the commands you requested link @MichaelHampton To be honest, I have checked/read Linux policy based routing without any luck of how to proceed. Any input in the right direction is much appreciated ! –  Digen N Sep 7 '13 at 11:24
    
Why do you have two separate subnets for your PCs? –  Michael Hampton Sep 24 '13 at 15:05
    
@MichaelHampton I know it's silly but administrators at work want separation of IP addresses for documentation w.r.t the Linux firewall which also runs Squid in Transparent mode. Based on the network, policies w.r.t web filtering have been configured in Squid. –  Digen N Sep 24 '13 at 15:13

1 Answer 1

I believe you need several fixes:

  • All the 192.168.2.0/24 machines need a network route out their interface for the 192.168.3.0/24 machines -- and vice versa.

  • All the 192.168.2.0/24 and 192.168.3.0/24 machines need a host route for 10.0.0.200 out their interface.

  • All the 192.168.2.0/24 and 192.168.3.0/24 machines need a network route for 192.168.0.0/24 via the 10.0.0.200 address.

  • All the 192.168.0.0/24 machines need a host route for 10.0.0.200 out their interface.

  • All the 192.168.0.0/24 machines need a default route of 10.0.0.200.

I might have overlooked one of the pieces, there's a lot of pieces here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.