0

I'm using iptables SNAT to setup a "router" on a linux box, it suppose to do NAT for 2 subnets. one untagged subnet 10.0.10.0/24, the other one is vlan tagged subnet 172.16.0.0/24. both subnet come from a switch to interface em2 on the linux box, and interface em1 connect to internet. the topology looks like below:

                                                     linux box
  client                                 switch      |--------|
  |-----|  eth1 untagged: 10.0.10.4/24   |----|      |        |
  |     |--------------------------------|    |------|em2  em1|----- internet
  |_____|  eth1 vid 103:  172.16.0.4/24  |____|      |        |
                                                     |________|

I use following commands to setup iptables.

iptables -F
iptables -F -t nat
iptables -F -t mangle

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING  -o em1 -j SNAT --to-source 137.58.251.244

after these iptables commands, the client machine can ping outside world through the untagged subnet, but the vlan tagged subnet will fail.

[root@bootstrap ~]# ping 91.189.88.141 -I eth1 -c 1
PING 91.189.88.141 (91.189.88.141) from 10.0.10.7 eth1: 56(84) bytes of data.
64 bytes from 91.189.88.141: icmp_seq=1 ttl=39 time=38.5 ms

--- 91.189.88.141 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 38ms
rtt min/avg/max/mdev = 38.521/38.521/38.521/0.000 ms


[root@bootstrap ~]# ping 91.189.88.141 -I eth1.103 -c 1
PING 91.189.88.141 (91.189.88.141) from 172.16.0.4 eth1.103: 56(84) bytes of data.
From 172.16.0.4 icmp_seq=1 Destination Host Unreachable

--- 91.189.88.141 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 3004ms

If we check on the linux box, seems the arp request come up from interface em2, but iptables didn't respond to the apr request.

root@vRAN-244:~# tcpdump -i em2 -ne -vvv host 91.189.88.141
tcpdump: WARNING: em2: no IPv4 address assigned
tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size 65535 bytes
15:00:37.304824 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 60: vlan 103, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42
15:00:38.306651 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 60: vlan 103, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42
15:00:39.308640 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 60: vlan 103, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42

3 packets captured
4 packets received by filter
0 packets dropped by kernel
root@vRAN-244:~# tcpdump -i em2.103 -ne -vvv host 91.189.88.141
tcpdump: WARNING: em2.103: no IPv4 address assigned
tcpdump: listening on em2.103, link-type EN10MB (Ethernet), capture size 65535 bytes
15:00:46.308651 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 56: Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42
15:00:47.310633 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 56: Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42
15:00:49.307858 00:25:90:54:22:ce > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 56: Ethernet (len 6), IPv4 (len 4), Request who-has 91.189.88.141 tell 172.16.0.4, length 42

Did I miss anything in the iptables rules?

  • 1
    Two issues with your question: 1. iptables has nothing to do with arp requests/responses, and 2. you will never get arp responses for a remote host: ARP are used for communicating with hosts on the local subnet. When you contact a remote host it will be sent trough the appropriate gateway (Default GW in most cases) and it's the GW IP that will be resolved using ARP. ARP does the resolution between Ethernet and IP addresses on the local subnet. – Thomas Guyot-Sionnest Aug 11 '15 at 13:58
  • Thank you, @ThomasGuyot-Sionnest! Yes, I think it should be something wrong with the gateway, will check there first... – user3016997 Aug 13 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.