0

I am having an issue with building a static route that spans 2 different subnets and a vpn connection. My topology looks like this:

  • Host-A: inet 10.0.28.45 netmask 255.255.224.0 broadcast 10.0.31.255
  • Host-B: inet 10.0.47.160 netmask 255.255.240.0 broadcast 10.0.47.255

  • Host-C: inet 172.16.254.133 netmask 255.255.255.0 broadcast 172.16.254.255

I have an OpenVPN connection that is initiated from Host-C to Host-B. The OpenVPN connection is on tun0 with a subnet of 192.168.100.0/24 so Host-B has a tun0 address of 192.168.100.2 and Host-C has an address of 192.168.100.5

Host-B has ip forwarding enabled and is doing ip-masquerading on firewalld.

I initiate my vpn connection and can reach Host-A from Host-C without issue. I want to be able to have Host-A reach Host-C as well. To my knowledge to add a static route, you need to have a host on the same subnet as your gateway. Since Host-A and Host-B are on different subnets I added a the 10.0.32.0 subnet to my routing table on Host-A.

My routing table on Host-A looks as follows:

# ip route list
default via 10.0.0.1 dev eth0 
10.0.0.0/19 dev eth0 proto kernel scope link src 10.0.28.45
10.0.32.0/20 via 10.0.0.1 dev eth0 
169.254.0.0/16 dev eth0 scope link metric 1002 

I then tried to add a route to Host-B which is on 10.0.32.0/20 subnet as:

ip route add 192.168.100.0/24 via 10.0.47.160

But I get the error: RTNETLINK answers: Network is unreachable

I understand that the gateway I'm trying to use here is outside the scope of the subnet that Host-A is in. I added the 10.0.32.0/20 subnet via 10.0.0.1 above to provide the route that that subnet should take which 10.0.47.160 is inside of but I'm not sure if this is the correct way to handle this case.

My routing table on Host-B looks as follows:

$ ip route list
default via 10.0.32.1 dev eth0 
10.0.32.0/20 dev eth0 proto kernel scope link src 10.0.47.160 
169.254.0.0/16 dev eth0 scope link metric 1002 
192.168.100.0/24 via 192.168.199.2 dev tun0 
192.168.100.2 dev tun0 proto kernel scope link src 192.168.199.1 

I want all traffic except traffic destined for 192.168.100.0 to continue to exit eth0 via 10.0.0.1.

I feel like part of my issue here is I am missing something in my routing table on Host-A which is why I am getting the Network unreachable error when I try to add a route to 192.168.100.0/24.

What am I missing here?

  • As the question stands, you've only listed the routes for Host-A and then asked about problems with Host-B. If you're adding routes to Host-B can you please include the route list for Host-B also? – tu-Reinstate Monica-dor duh Jun 26 at 4:46
  • Also, tcpdump is your friend. ;-) Even if you're not getting a response from Host-B that doesn't mean that the packets aren't getting there, they may just be unable to get back. – tu-Reinstate Monica-dor duh Jun 26 at 4:48
  • Its my understanding that packets are not sent yet when doing ip route add. Is that not the case ? – johca Jun 26 at 4:55
  • All these commands take effect straight away. As soon as you add the route successfully (no errors), the packets will go via that route. – tu-Reinstate Monica-dor duh Jun 26 at 4:56
  • So you want 192.168.100.0/24 to find gateway 10.0.47.160 which is on network 10.0.32.0/20 via gateway 10.0.0.1 on the default network 10.0.0.0/19? – tu-Reinstate Monica-dor duh Jun 26 at 5:10
1

10.0.47.160 is outside the range of 10.0.0.0/19

From the IP calculator:

Address:   10.0.0.0              00001010.00000000.000 00000.00000000
Netmask:   255.255.224.0 = 19    11111111.11111111.111 00000.00000000
Wildcard:  0.0.31.255            00000000.00000000.000 11111.11111111
=>
Network:   10.0.0.0/19           00001010.00000000.000 00000.00000000 (Class A)
Broadcast: 10.0.31.255           00001010.00000000.000 11111.11111111
HostMin:   10.0.0.1              00001010.00000000.000 00000.00000001
HostMax:   10.0.31.254           00001010.00000000.000 11111.11111110
Hosts/Net: 8190                  (Private Internet)

So 10.0.47.160 > 10.0.31.254 and the network is unreachable.

If you make your 10.0.0.0/19 network that would conflict with your 10.0.32.0(/32) route.

I think you may mean that the 10.0.32.0 via 10.0.0.1 should actually be 10.0.32.0/19 via 10.0.0.1.

After the Update

So your new route list is:

# ip route list
default via 10.0.0.1 dev eth0 
10.0.0.0/19 dev eth0 proto kernel scope link src 10.0.28.45
10.0.32.0/20 via 10.0.0.1 dev eth0 
169.254.0.0/16 dev eth0 scope link metric 1002 

And you want to add:

ip route add 192.168.100.0/24 via 10.0.47.160

The error you now would get would be different:

Error: Nexthop has invalid gateway.

In other words, you can't do this because the gateway is not local to you, it's someone else's gateway. You need an interface with a source IP that's in the same range as the gateway you're trying to connect to.

Your only source IP address (10.0.28.45) wouldn't be in the gateway's range 10.0.32.0/20, and if we allowed packets from anywhere then we could, potentially end up with all sorts of holes and loops in our network.

Conversely, how would it get back? The foreign gateway would receive a packet and send it back via it's default route because Host-A wouldn't be local to it, either.

Basically, you're asking the router to remap the source IP, but that's not applicable until it arrives at the first gateway 10.0.0.1 and, by then, it doesn't know the path to get back, since packets don't have a breadcrumb trail.

There are lots of ways to solve this problem, but it depends on the network you want. I'd look into tunnels (tap and tun) or GRE or virtual switches which do these kinds of remapping IPs and tracking foreign connections as though they were local. They create virtual interfaces in the same range as the destination, and that's how VPNs actually work.

Thankfully these solutions are a lot easier than they used to be!

  • Yes, that's why i added 10.0.30.0/20 – johca Jun 26 at 4:28
  • Yep, but you actually have 10.0.32.0/32 via 10.0.0.1. You just forgot to add the netmask so it assumed /32. – tu-Reinstate Monica-dor duh Jun 26 at 4:30
  • I was wrong on my previous comment. You are correct on 10.0.32.0. On Host-B my routing table looks like this: default via 10.0.32.1 dev eth0 10.0.32.0/20 dev eth0 proto kernel scope link src 10.0.47.160 ` so shouldn't I be using that same subnet? The host I want to use as a gateway is definitely outside of 10.0.0.0/19 which is where I'm getting hung up. – johca Jun 26 at 4:35
  • Please edit the question to add additional information rather than comments. – tu-Reinstate Monica-dor duh Jun 26 at 4:36
  • sorry, I've updated the original question. thanks. – johca Jun 26 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.