1

I am attempting to operate 2 subnets, the first subnet on range 192.168.0.0/24 is free to access anything it wants, including machines on the second subnet. the second subnet on range 10.0.0.0/24 is restricted to only being able to access the outside world. I do not want machines with a source within 10.0.0.0/24 to be able to access machines in the 192.168.0.0/24 range but i do want it to be able to go outside.

On top of this, in the 192.168.0.0/24 range i also want 2 gateways, the first being the default gateway (currently in the form of an Ubuntu VM) which routes traffic via a vpn, its address is 192.168.0.250 and the second gateway (which is the internet-facing TP-Link wireless router) at 192.168.0.1 (also the DHCP & DNS server for the 192.168.0.0/24 range)

I also have a third gateway for bridging the two subnets, another Ubuntu VM with 2 NICS, the first being 192.168.0.251 and the second being 10.0.0.1

Now that I have explained the network i want, here is my setup and what i am experiencing:

Ubuntu VM on 192.168.0.250

the route table on 192.168.0.250 looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.0.0.0        192.168.0.251   255.255.255.0   UG    0      0        0 eth0
10.8.0.0        *               255.255.0.0     U     0      0        0 tun0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
.               192.168.0.1     255.255.255.255 UGH   0      0        0 eth0

I add the routes via

 ip rule add from 192.168.0.0/24 table default
 ip route add 10.0.0.0/24 via 192.168.0.251
 ip rule add from 10.0.0.0/24 table sandboxgateway
 ip route add default via 192.168.0.1 dev eth0 table sandboxgateway

If i remove the two sandboxgateway lines i can access 10.0.0.1 but anything in the 10.0.0.X range is accessing the internet through the VPN, which is not what i want. and its iptable looks like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Ubuntu VM on 192.168.0.251/10.0.0.1

the route table on 192.168.0.251(eth0)/10.0.0.1(eth1) looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     255.255.255.255 UGH   0      0        0 eth0
default         192.168.0.250   0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth1
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

and its iptable looks like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  10.0.0.0/24          192.168.0.0/24

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The issue

The issue I am having is that while my machine at 192.168.0.2 can access the outside world either via 192.168.0.1 or 192.168.0.250 as its gateway, as can my machine at 10.0.0.10 access the outside world without accessing anything at 192.168.0.X, my machine at 192.168.0.2 cannot access either 10.0.0.1 or 10.0.0.10, and a tracert from the windows command prompt results in

Tracing route to 10.0.0.1 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.0.250
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.

Why is 192.168.0.250 not routing to 192.168.0.251??

Apologies if i have included too much or too little information, please ask if any additional details are needed to answer this question.

  • First of all edit /etc/sysctl.conf. Uncomment (or edit) the line there with: net.ipv4.ip_forward = 1 – Anton Makovetsky Apr 12 '16 at 13:36
  • This allows packet forwarding between two NICs (after reboot) – Anton Makovetsky Apr 12 '16 at 13:38
  • @AntonMakovetsky that has already been done, as i said 10.0.0.X can access the outside world – Trotski94 Apr 12 '16 at 13:47
  • 1
    By 192.168.0.0/8 you must really mean 192.168.0.0/24, right? – joeqwerty Apr 12 '16 at 16:58
  • @joeqwerty When i wrote the question they were actually set to /8, i realised that mistake and changed them all to /24, ill update the question to reflect that. It's still suffering from the same issue, though. – Trotski94 Apr 13 '16 at 8:31
0

The iptables packetfilter drops the responses of the 10.0.0.0/8 ips to the 192.168.0.0/8 IPs. Add a rule to allow packets from 10.0 to 192.168 that are already established, before the DROP rule:

-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

That should do the trick. If not, remove the DROP rule to check if that is really the origin of the problem. If so, you might have to build a more sophisticated ruleset.

  • aha yes this seems pretty obvious if it is the cause, i shall try this now. – Trotski94 Apr 12 '16 at 13:48
  • OK, adding that did not help, however removing the previous one and removing the ip rule add from 192.168.0.0/8 table default, ip rule add from 10.0.0.0/8 table sandboxgateway,ip route add default & via 192.168.0.1 dev eth0 table sandboxgateway commands allows 192.168.0.2 to ping 10.0.0.10. I will experiment some more based on this. This issue with this is obviously that 10.0.0.10 can access 192.168.0.0/8 and its tunneling through the VPN, both undesirable. – Trotski94 Apr 12 '16 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.