Linux Firewall & sharing files between computers in different subnets connected to single switch

Question

EDIT : I've edited the question & the title to bring more clarity hoping that someone will be able to point me in the right direction.

           *************************
           * Internet Modem/Router *    
           *    192.168.1.1        *
           *************************
                     *                   
                     *    
                     *  192.168.1.2(eth0)
           *************************
           *    Linux Firewall     *  
           ************************* 
                    *   192.168.2.1(eth1) , 192.168.3.1(eth1:0) <--- (Virtual Interface)
                    *
                    *
                    *
           *************************       ***********
           *        Switch         * * * * * Router  ********** 192.168.0.x network.
           *************************       ***********
           *                      *         10.0.0.200
           *                      *
           *                      *
           *                      *
           *                      *
         * * * *                * * * *
         * PC  *                * PC  *
         * * * *                * * * *

    IP:192.168.2.10          IP: 192.168.3.10
  Gateway: 192.168.2.1      Gateway: 192.168.3.1  

Gateway's of both the networks i.e 192.168.2.0/24 and 192.168.3.0/24 computers are both residing in the Linux firewall machine namely 192.168.2.1(eth1) , 192.168.3.1(eth1:0 -Virtual Interface).

Note: Computers in 192.168.2.0/24 and 192.168.3.0/24 network are both connected to a single switch.

1. The computers in the 192.168.2.0/24 network and the computers in the 192.168.3.0/24 network should be able to share files with each other, ping, ssh etc.

2. Machines from 192.168.2.0/24 or 192.168.3.0/24 accessing machines in 192.168.0.x network, packets of the same should be sent to the router 10.0.0.200.

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

iptables -L Chain INPUT (policy DROP) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere 192.168.1.2 tcp spts:login:65535 dpt:ssh >state NEW,ESTABLISHED ACCEPT tcp -- anywhere 192.168.1.2 tcp spts:login:65535 dpt:ndmp >state NEW,ESTABLISHED ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT) target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- 192.168.1.2 anywhere tcp spt:ssh dpts:login:65535 state ESTABLISHED ACCEPT tcp -- 192.168.1.2 anywhere tcp spt:ndmp dpts:login:65535 state ESTABLISHED ACCEPT all -- anywhere anywhere

Machine: 192.168.2.10

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.10 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.2.0 255.255.255.0 192.168.2.10 192.168.2.10 10
192.168.2.12 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.2.10 192.168.2.10 10
224.0.0.0 240.0.0.0 192.168.2.10 192.168.2.10 10
255.255.255.255 255.255.255.255 192.168.2.10 192.168.2.10 1

Default Gateway: 192.168.2.1

Persistent Routes:
None

Machine: 192.168.3.10

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.10 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.2.0 255.255.255.0 192.168.3.10 192.168.3.10 10
192.168.2.12 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.3.10 192.168.3.10 10
224.0.0.0 240.0.0.0 192.168.3.10 192.168.3.10 10
255.255.255.255 255.255.255.255 192.168.3.10 192.168.3.10 1

Default Gateway: 192.168.3.1

Persistent Routes:
None

For much easier reading the output of the above commands is available at Pastebin here

I've read LARTC but frankly it's intimidating at this point. I am a little short of knowledge/information on where to begin. Any inputs in pointing me in the right direction will help.

Answer 1

I believe you need several fixes:

• All the 192.168.2.0/24 machines need a network route out their interface for the 192.168.3.0/24 machines -- and vice versa.

• All the 192.168.2.0/24 and 192.168.3.0/24 machines need a host route for 10.0.0.200 out their interface.

• All the 192.168.2.0/24 and 192.168.3.0/24 machines need a network route for 192.168.0.0/24 via the 10.0.0.200 address.

• All the 192.168.0.0/24 machines need a host route for 10.0.0.200 out their interface.

• All the 192.168.0.0/24 machines need a default route of 10.0.0.200.

I might have overlooked one of the pieces, there's a lot of pieces here.