0

I have three wireless speakers that, for security reasons, only permit local subnet control. My network is setup such that the wired and wireless devices are on separate subnets, so right now the speakers cannot be used from the wired clients. I can setup a Ubuntu 18.04 virtual machine with interfaces in both subnets, but am not familiar enough with iptables to configure the forwarding correctly.

The speakers have IP addresses 192.168.100.200, 192.168.100.201, and 192.168.100.202. The wired clients exist in the 192.168.50.0/24 subnet. Each speaker needs to have two ports (8000, 9000) reflected. My reflection virtual machine has interfaces in both subnets, 192.168.100.250 and 192.168.50.250. What is the correct iptables setup to do the following:

192.168.50.250:8000 -> 192.168.100.200:8000 via 192.168.100.250
192.168.50.250:8001 -> 192.168.100.201:8000 via 192.168.100.250
192.168.50.250:8002 -> 192.168.100.202:8000 via 192.168.100.250
192.168.50.250:9000 -> 192.168.100.200:9000 via 192.168.100.250
192.168.50.250:9001 -> 192.168.100.201:9000 via 192.168.100.250
192.168.50.250:9002 -> 192.168.100.202:9000 via 192.168.100.250

Does this setup make sense? Short of changing out the speakers for ones that are more compatible with my network setup, is there an easier way to do this that I did not think of?

4
  • Please do not use NAT as a substitute for routing. Simply route between the different networks. That is what routers do. You only use NAT for public<-> private or overlapping networks. Different private networks just need routing. – Ron Maupin May 30 '20 at 11:49
  • @RonMaupin Routing exists between the two different networks and works fine, except the speaker devices themselves are refusing connections from outside their local subnet. How could I use routing to circumvent this limitation? I think I have no choice but to do some type of NAT... – user986713 May 30 '20 at 15:09
  • NAT is your problem, You can just route without NAT, and it will work. Simply add a route to the other network in your hosts that points to the "router". – Ron Maupin May 30 '20 at 15:22
  • @RonMaupin The two networks are VLANs and normally the routing between the two VLANs is handled by Cisco SG500 switches using L3 routing. The switches create the VLAN routes automatically. I went ahead and added a static route on my local machine to the wireless network gateway (the switch) via sudo route -n add -net 192.168.100.0/24 192.168.100.254. Unexpectedly, when I tried to ping a speaker after adding a route, I received ping: sendto: Network is unreachable errors whereas previously I would get a standard Request timeout for icmp_seq X error. – user986713 May 30 '20 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.