1

I our lab we have a small network of 4 Debian machines, connected through a router in a LAN. One of these machines (the server) have internet connection provided by the bigger network of the building. I want to give internet to the inner machines on LAN using NAT. I followed this guide but I cannot get a working connection from clients.

The IP of the server at eth0 is 192.168.2.248 (connected to the internet); and the eth1 is 192.168.200.1 (connected to the LAN). I setup bind9 (with standard conf, but adding the correct DNS addresses to /etc/bind/named.conf.options) to forward the DNS but I not sure if this is absolutely necessary.

$ iptables-save 
# Generated by iptables-save v1.4.21 on Mon Aug 22 16:06:21 2016
*nat
:PREROUTING ACCEPT [46792:8129746]
:INPUT ACCEPT [46302:8099043]
:OUTPUT ACCEPT [2752:190850]
:POSTROUTING ACCEPT [1472:88500]
-A POSTROUTING -o eth0 -j SNAT --to-source 192.168.2.248
COMMIT
# Completed on Mon Aug 22 16:06:21 2016
# Generated by iptables-save v1.4.21 on Mon Aug 22 16:06:21 2016
*filter
:INPUT ACCEPT [61997:8558568]
:FORWARD ACCEPT [11:836]
:OUTPUT ACCEPT [9258:2611777]
-A FORWARD -i eth1 -j ACCEPT
COMMIT
# Completed on Mon Aug 22 16:06:21 2016

I can connect the machines using ssh or ping between them, but I still cannot connect or ping the internet from the client machine (eth0 IP 192.168.200.2). This is the gateway on this:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.200.1   0.0.0.0         UG    0      0        0 eth0
192.168.200.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

/proc/sys/net/ipv4/ip_forward is 1

Any help are welcome

Improve this question
3
  • 4
    Have you really configured both client and server with the IP address 192.168.200.1? – kasperd Aug 22 '16 at 19:36
  • You don't need bind set up on the server, the client machines can use the same DNS as the outer network once the NAT is working correctly. – Tero Kilkanen Aug 22 '16 at 20:22
  • The IP of the client is 192.168.200.2 (typing error) – FVillanelo Aug 23 '16 at 13:15
0

you don't need to use bind, you could set a DNS server outside your network (like Google DNS 8.8.8.8 / 8.8.4.4) but your first problem is at the IP layer.

If you SNAT with 192.168.2.248 you should set up your default route to target this way (something like 192.168.2.254) on your gateway.

Do you have any responce when you ping 8.8.8.8 from your gateway ?

  1. Verify that your Gateway have internet (ping 8.8.8.8)
  2. You should ping your gateway from your client
  3. Try to use -j MASQUERADE instead of -j SNAT
Improve this answer
1
  • I remove bind and now work. I try before without bind and don't work, but maybe in that moment the iptables wasn't configured correctly. I have SNAT in place of MASQUERADE because the static IP. Thanks anyway! – FVillanelo Aug 23 '16 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.