I have two networks that I'd like to connect with a router/firewall to filter traffic between the two. One network is on a public subnet, let's say and the other network is on a private subnet The are connected via a router which has three Ethernet ports, one connected to the internet, the other two connected to the public and private subnets and are on their own VLANS. How do I make the private subnet visible to the public network? Here's the network diagram:

  • Router1 >eth0 --- Connected to Internet
  • Router1 >eth1 --- Connected to VLAN 64 Subnet
  • Router1 >eth3 --- Connected to VLAN 192 Subnet

I tried static routing to on the router I also tried routing it to Neither worked.

I want traffic between the two subnets to pass through the router because I want to be able to setup firewall rules on the router between the subnets.

  1. I tried static routes but couldn't get it to work, am I doing something wrong?

  2. I realize I could use NATing but in order to access individual private IP machines, I would have to set up a one-to-one NAT which would eat up my precious limited public IPs

  3. Do I have to setup a Tunnel to accomplish this? Wouldn't a tunnel bypass the firewall rules?

IP route show:

default via dev eth0  proto zebra dev eth3  proto kernel  scope link  src dev eth1  proto kernel  scope link  src dev eth0  proto kernel  scope link  src dev lo  proto kernel  scope link  src 
  • 1. What make/model of router? 2. Can you post the roting table from the router? 3. You shouldn't have to manually do anything to get the traffic routed between the internal subnets as the router has an interface directly connected to both internal sunets, just as you shouldn't have to manually do anything to get trafiic routed between each of the internal subnets and the external subnet. 4. Do the hosts on each internal subnet have the router as their DG, using the appropriate ip address of the respective router interface? – joeqwerty Sep 24 '12 at 23:11
  • Based on your text, I would guess you're using a Linux box as your router/firewall. Please post the routing table (route -n) and your firewall rules (iptables -nvL). – Michael Hampton Sep 24 '12 at 23:15
  • I'm using vyatta for router/firewall, I updated it with the ip route show output – Stallionz Sep 24 '12 at 23:22
  • I should comment that I can ping the port on the other end just fine. From I can ping just fine. – Stallionz Sep 24 '12 at 23:28
  • What do the hosts on, and have as the default gateway? Are they pointed at the Linux box, or something else? – Zoredache Sep 24 '12 at 23:29

I tried static routes but couldn't get it to work

You shouldn't need static routes, your system already has all the routes it should need. Linux automatically configures routes for every network that is locally attached. Assuming you have ip_forward enabled, and no firewall rules in place currently blocking traffic, everything should just work.

Do I have to setup a Tunnel to accomplish this?

No, you shouldn't need any tunnels.

I realize I could use NATing but in order to access individual private IP machines,

You shouldn't need any NAT rules. In fact if you already have an overly-broad SNAT/MASQ setup that might be your problem.

Assuming all the clients on and are using your linux box as the their default gateway, and you don't have any SNAT/MASQ rules setup to change the source address of traffic going from eth3 -> eth1 communication should just work.

  • Indeed I didn't think I needed the static routes but tried it when I couldn't get it to work. The problem turned out to be the machine I was trying to ping, I can ping other machines just fine. I removed the static routing – Stallionz Sep 24 '12 at 23:58
  • What do you mean by overly-broad? I need the subnet to be able to access the internet, don't I need the masquerading for it? Or do you simply mean I should limit the ports on the NAT (I was going to do that with the firewall anyways) – Stallionz Sep 24 '12 at 23:59
  • I mean if you added a rule like iptables -s -j MASQ then your system would NAT traffic from the private subnet when it accesses the You would probably want to an additional condition that limits the MASQ/SNAT so that it only applies when it is leaving the eth0 interface. Something like iptables -s -o eth0 -j MASQ perhaps. – Zoredache Sep 25 '12 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.