Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have been attempting to setup a Linux/BSD/etc box that can behave as both an internet gateway and as a router. I don't know how to articulate our situation very well, so please forgive me...

Currently we are using Vyatta with the following network interfaces (with masked IP addresses):

  • eth0 -> x.x.x.178/30 - WAN (upstream router: x.x.x.177)
    • vlan100 -> Attached to eth0
  • br100 -> y.y.y.1 - Bridges eth0.vlan100 and eth1
  • eth1 -> y.y.y.y/24 - Bridged with the WAN (x.x.x.178 is the upstream router for this subnet)
  • eth2 -> 10.10.0.1/16 - Private network, NAT through y.y.y.1

The problem is: when we set the NAT rule to route 10.10.0.0/16 traffic through br100 nothing gets routed. However, if we set the NAT rule to route through eth0, the traffic actually routes, but now it is sourced from the x.x.x.178 address instead of the y.y.y.1 address.

What am I doing wrong here? Any thoughts or suggestions would be helpful.


Current configuration (minus some fluff):

interfaces {
    bridge br100 {
        address y.y.y.1/24
    }
    ethernet eth0 {
        address x.x.x.178/30
        vif 100 {
            bridge-group {
                bridge br100
            }
        }
    }
    ethernet eth1 {
        bridge-group {
            bridge br100
        }
    }
    ethernet eth2 {
        address 10.10.0.1/16
    }
    loopback lo {
    }
}
services {
    nat {
        rule 1 {
            outbound-interface br100
            source {
                address 10.10.0.0/16
            }
            type masquerade
        }
    }
}
system {
    gateway-address x.x.x.177
}
share|improve this question

3 Answers 3

up vote 2 down vote accepted

The way that we were able to solve this was to change the NAT rule to an SNAT instead of a masquerade.

share|improve this answer

On most distro, unless they are set up to serve as routers, they will default to the behavior of refusing to forward IP traffic. Generally I use a packetprotector (linux running on asus home router) for such work. But you will want to check the settings in /etc/sysctl.conf.

Look for 'net.ipv4.ip_forward = ', if you wish to forward traffic, this value should be set to 1 (if not then '0'). Changing the file here will have the change persist across reboots, and will start when network services start.

share|improve this answer
1  
very good point. This might be worth reading: ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux –  BuildTheRobots Dec 31 '09 at 16:26
1  
Thank you for the suggestion! I always seem to forget that when I setup a Linux distro, but that is one of the things I checked this time. Vyatta is a firewall distro and it has ip forwarding on by default. –  miquella Jan 1 '10 at 17:24

I would recommend you use pfSense.

It has a really nice Web-based interface.

share|improve this answer
1  
Thank you for the suggestion, but pfSense is the last one we tried. The reason we're using Vyatta at all is because pfSense stopped routing our traffic... Don't know why, it worked fine for 2 weeks and then it just stopped routing. –  miquella Jan 1 '10 at 17:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.