0

I have a very simple gateway running a minimal Linux which is serving as an IP router with NAT and DHCP on the LAN, and a static IP on the WAN. The gateway router from the LAN side goes to a big switch from which about 200 users gain access (DHCP assigns them NAT addresses). Of these 200 hosts on the LAN I have one which (call it Argon) that I'd like to access at a fixed static IP address from both within the LAN and from the WAN. Let's say my NAT is 192.168.1.0/24, the LAN address on my gateway is 192.168.1.1, Boron is a host on the LAN with IP 192.168.1.2, and Carbon is a host on the WAN with the IP 1.1.1.1.

Say that I own the IP 10.10.10.10. I'd like to assign 10.10.10.10 to Argon, and be able to send and receive both TCP and UDP traffic from both Boron (at 192.168.1.2) and from Carbon (at 1.1.1.1) where both Boron and Carbon would send messages to the IP address 10.10.10.10 to reach Argon.

I don't think my router has the capability to run DNS or VPN so I'd like to avoid these routes as solutions if possible. However if the constraints I've places make the problem unsolvable I'd prefer to set up a DNS as a solution rather than VPN so if anyone has a DNS solution for this problem (that isn't dynamic DNS) I'd appreciate those solutions too.

Apologies if the question is basic, or not on point; I'm definitely a networking novice.

Thank you for your help.

Improve this question

2 Answers 2

Reset to default
1

If 10.10.10.10 already points to the WAN interface on your router, you should just have to add a static route to the internal host on the router.

ip router add 10.10.10.10/32 dev eth1

Where eth1 is the LAN side nic on the router. (Ensure that ip forwarding is on for both interface wan and lan on the router).

Then just assign 10.10.10.10/32 to the nic on Argon. Unless it has a LAN IP in the 192.168.1.1/24 subnet, Argon will have to set it's route as:

ip route add 192.168.1.1/24 dev eth0
ip route add default via 192.168.1.1

internal clients should have no trouble. Packets will leave internal hosts via the NIC defined for the default gateway. The default gateway is your router. The route has a route to 10.10.10.10/32 back out it's LAN interface.

I think this should work. If it doesn't, you'll have to figure out how to deal with hairpin forwarding on your distribution. (I really think it should work by default in most cases...).

If you want to attempt to assign 10.10.10.10/32 to the router itself and then use NAT to direct everything to an internal IP for Argon the magical phrase becomes "Hairpin NAT". You can read more about that rabbit hole here: Can't access domain internally via public IP address

And for the sake of completion... if 10.10.10.10 does not currently point to your router's wan nic... you will have to talk to the provider about getting 10.10.10.10 routed to your router. (Consumer grade equipment won't cut it here)

For those that like pictures (I'm not great at diagrams and all I had installed was paint) here is what the routes look like without NAT:

Linux Hairpin Routing without NAT

Improve this answer
2
  • If the first configuration doesn't work. You can add a 'bridge interface' to the router, assign the lan ip to the bridge and add the lan nic to the bridge. The bridge should then have an option available to enable hairpin...
    – Daniel Widrick
    Aug 11, 2015 at 23:31
  • Thanks a lot for your help Daniel, I was able to get your first solution to work but you hairpin diagram was actually very helpful in that; so thanks for taking the time to draw it.
    – darkhipo
    Aug 12, 2015 at 19:03
1

What you are describing is called SNAT or 1:1 NAT in other terms. It maps a single address on one network, to a single address on another and is the most common way to expose services on a single host (usually to the internet) on the planet. So providing your gateway supports it, you need to create a 1:1 NAT of 10.10.10.10 to 192.168.1.2.

All traffic to 10.10.10.10 is then directed at 192.168.1.2 and all traffic leaving the network via the 10 interface on the gateway would come from 10.10.10.10.

Hope this helps!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .