1

Unfortunately I have very little practice with routing in linux and also I was not able to properly phrase my issue for a search.

So I will explain the issue here. In the picture below you see the topolgy of my network. The goal is that the client device with the ip 10.0.0.50 can access the target device with the ip 192.168.0.1.

Picture of the network topology

Setting the proper route on the client device is not my goal, because there may be multiple client devices with the need to access 192.168.0.1. Due to the reason that I do not have access to all of the clients it is not the goal to configure them individually to achieve the goal.

So far I tried setting a route on the gateway 10.0.0.1 with route add -net 192.168.0.0/25 gw 10.0.0.99. The gateway is (should be) properly configured to forward the packages, because I use it as the gateway for the whole network to access the internet. So iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE is set as well as ip forwarding with echo 1 > /proc/sys/net/ipv4/ip_forward. route shows the following output on the gateway:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         123.123.123.1   0.0.0.0         UG    202    0        0 eth0
10.0.0.0        *               255.255.255.128 U     0      0        0 br0
123.123.123.2   *               255.255.255.252 U     0      0        0 eth0
192.168.0.0     10.0.0.99       255.255.255.128 UG    0      0        0 br0

The configuration on the server 10.0.0.99 includes the iptable rules for masquerading and the ip forwarding as well. route shows the following output on the server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         tower           0.0.0.0         UG    204    0        0 br0
default         192.168.0.1     0.0.0.0         UG    303    0        0 wlan0
10.0.0.0        *               255.255.255.128 U     0      0        0 br0
192.168.0.0     *               255.255.255.128 U     0      0        0 wlan0

With the setup explained above I can ping 192.168.0.1 from the server as well as from the gateway, but the clients are not able to do it. A traceroute to test what is happening gets stuck at the gateway 10.0.0.1 and does not progress any further.

I have also tried to set iptables -A POSTROUTING -t nat -o br0 -j MASQUERADE on the gateway as well to check if that is the issue, but that rule did not help so I removed it again.

What am I missing here? Please help me out. Thank you very much!

2
  • There is a difference between NATting/Masquerade and routing. Those iptables commands that you're running is to setup NAT. Can you please clarify whether you want to NAT or Route?
    – Lawrence
    May 2, 2019 at 4:55
  • Since the actual router for 192.168.0.0/24 network is in the same subnet as the gateway clients are using, the gateway might send ICMP redirect message to client, which tells the client to send packets directly to 10.0.0.99. The client might not understand this message correctly and that could cause the failure. Another thing is, how is the target's routing configured? May 2, 2019 at 6:30

1 Answer 1

1
  1. If you use the linux, stop use the ifconfig and the route. Use the ip (man ip and read the iproute tutorials).
  2. Setup the route on the internet gateway: ip route add 192.168.0.0/25 via 10.0.0.99
  3. Disable the redirects: sysctl -w sys.net.ipv4.conf.br0.send_redirects.
  4. Check the routing with command ip route get 192.168.0.1 from 10.0.0.50 iif br0. The output should be seem like
192.168.0.1 from 10.0.0.50 via 10.0.0.99 dev br0 
    cache iif br0
  1. Optionally add the SNAT/MASQUERADE rule to make the replies passed through the internet gateway, not directly from the server to the client:
iptables -t nat -A POSTROUTING \
         -o br0 \
         --src 10.0.0.0/24 --dst 192.168.0.0/25 \
    -j SNAT --to 10.0.0.1
  1. Enable the forwarding on the server: sysctl -w sys.net.ipv4.ip_forward=1
  2. Above steps are enough in most cases. Optionally, if the target has other default gateway (not through the server), you can add the route on the target (ip route add 10.0.0.0/24 via 192.168.0.X, where 192.168.0.X is address of the server in 192.168.0.0/25 subnet) or setup the NAT on the server itself (iptables -t nat -A POSTROUTING -o wlan0 --src 10.0.0.0/24 --dst 192.168.0.1 -j MASQUERADE).
  3. Check connectivity:
    • on the gateway ping the server and the target.
    • on the server ping the gateway and the target.
    • use the tcpdump to troubleshoot future issues.
3
  • thank you very much. Using some of the mentioned things of you post I finally got it to work*. May 8, 2019 at 12:49
  • *I did not need to change the send_redirects setting (what would be the benefit of that step?). Also I have discovered that iptables did block my configuration so I had add the following rule: iptables -A FORWARD -i br0 -o br0 -j ACCEPT. I guess there is still an issue in iptables left, because without enabling the snat rule I can send pings to the target, but besides that e.g. a http request does not succeed. Any idea what could be missing? Anyway, thank you very much! May 8, 2019 at 12:56
  • If ping works, but http doesn't, then check the firewall. Start with tcpdump and check the tcp handshake to detect, what's going on. Use iptables-save -c to list the full rule set with counters. Also, there is hairpin option for a linux bridge port, that can make various effects. May 10, 2019 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .