In a few days I'm going to be working on some field hardware, consisting of half a dozen Centos boxes networked together but not to the Internet. To do my work (in particular, to apply updates) I will need to temporarily connect these little networks to the Internet.
Most likely, my upwards connection will be through my Fedora laptop's wifi interface (and then onwards via a 4G modem). The general idea is to do NAT on my laptop, plug its ethernet interface into the field network with a suitable local IP, and temporarily set this as the default route on the field machines.
So far so good, but a complication arises from the fact that some of the updates will need to come from our company network (via a proprietary VPN client on my laptop) and some from the public Internet. The VPN server doesn't pass non-office traffic onwards to the Internet, clients are expected to only route "office" packets over the VPN and to send Internet traffic directly.
I'm not particularly expert with routing, iptables, etc. I've picked up these snippets of config which almost do the NAT I require:
iptables -A FORWARD -i $NAT_IF -j ACCEPT
iptables -A FORWARD -o $NAT_IF -j ACCEPT
iptables -t nat -A POSTROUTING -o $WAN_IF -j MASQUERADE
...where $NAT_IF is my laptop's ethernet port (the local side) and $WAN_IF is either the wifi interface or the ppp interface created by the VPN client. So with this I can let the client machines connect either to the Internet, or to the company office, but not both at once. This isn't very convenient when one dnf update command might need to pull both some public RPMs and some proprietary company ones.
Unfortunately I'm not in a position to try it right now, but maybe this is as simple as duplicating the last line above, with one using the VPN as $WAN_IF and one the wifi interface. However, I suspect not, because it doesn't seem to do anything to specify which packets need to go up the ppp interface (anything for 10.0.0.0/8) and which direct to the wifi (everything else).
What do I need to do on my laptop (acting as router) to let machines on the local network talk to both the office and the Internet, with the distinction between the two very preferably being made on the laptop rather than having to do config on each client?
Thanks for your help.
-d 10.0.0.0/8on the-o ppp0rule, and ensuring that one comes before the-o wifione, ought to do it, right? – Pete Verdon Jun 25 '17 at 23:23