Multi-subnet static routes

Question

I am having an issue with building a static route that spans 2 different subnets and a vpn connection. My topology looks like this:

• Host-A: inet 10.0.28.45 netmask 255.255.224.0 broadcast 10.0.31.255

• Host-B: inet 10.0.47.160 netmask 255.255.240.0 broadcast 10.0.47.255

• Host-C: inet 172.16.254.133 netmask 255.255.255.0 broadcast 172.16.254.255

I have an OpenVPN connection that is initiated from Host-C to Host-B. The OpenVPN connection is on tun0 with a subnet of 192.168.100.0/24 so Host-B has a tun0 address of 192.168.100.2 and Host-C has an address of 192.168.100.5

Host-B has ip forwarding enabled and is doing ip-masquerading on firewalld.

I initiate my vpn connection and can reach Host-A from Host-C without issue. I want to be able to have Host-A reach Host-C as well. To my knowledge to add a static route, you need to have a host on the same subnet as your gateway. Since Host-A and Host-B are on different subnets I added a the 10.0.32.0 subnet to my routing table on Host-A.

My routing table on Host-A looks as follows:

# ip route list
default via 10.0.0.1 dev eth0 
10.0.0.0/19 dev eth0 proto kernel scope link src 10.0.28.45
10.0.32.0/20 via 10.0.0.1 dev eth0 
169.254.0.0/16 dev eth0 scope link metric 1002 

I then tried to add a route to Host-B which is on 10.0.32.0/20 subnet as:

ip route add 192.168.100.0/24 via 10.0.47.160

But I get the error: RTNETLINK answers: Network is unreachable

I understand that the gateway I'm trying to use here is outside the scope of the subnet that Host-A is in. I added the 10.0.32.0/20 subnet via 10.0.0.1 above to provide the route that that subnet should take which 10.0.47.160 is inside of but I'm not sure if this is the correct way to handle this case.

My routing table on Host-B looks as follows:

$ ip route list
default via 10.0.32.1 dev eth0 
10.0.32.0/20 dev eth0 proto kernel scope link src 10.0.47.160 
169.254.0.0/16 dev eth0 scope link metric 1002 
192.168.100.0/24 via 192.168.199.2 dev tun0 
192.168.100.2 dev tun0 proto kernel scope link src 192.168.199.1 

I want all traffic except traffic destined for 192.168.100.0 to continue to exit eth0 via 10.0.0.1.

I feel like part of my issue here is I am missing something in my routing table on Host-A which is why I am getting the Network unreachable error when I try to add a route to 192.168.100.0/24.

What am I missing here?

Answer 1

10.0.47.160 is outside the range of 10.0.0.0/19

From the IP calculator:

Address:   10.0.0.0              00001010.00000000.000 00000.00000000
Netmask:   255.255.224.0 = 19    11111111.11111111.111 00000.00000000
Wildcard:  0.0.31.255            00000000.00000000.000 11111.11111111
=>
Network:   10.0.0.0/19           00001010.00000000.000 00000.00000000 (Class A)
Broadcast: 10.0.31.255           00001010.00000000.000 11111.11111111
HostMin:   10.0.0.1              00001010.00000000.000 00000.00000001
HostMax:   10.0.31.254           00001010.00000000.000 11111.11111110
Hosts/Net: 8190                  (Private Internet)

So 10.0.47.160 > 10.0.31.254 and the network is unreachable.

If you make your 10.0.0.0/19 network that would conflict with your 10.0.32.0(/32) route.

I think you may mean that the 10.0.32.0 via 10.0.0.1 should actually be 10.0.32.0/19 via 10.0.0.1.

After the Update

So your new route list is:

# ip route list
default via 10.0.0.1 dev eth0 
10.0.0.0/19 dev eth0 proto kernel scope link src 10.0.28.45
10.0.32.0/20 via 10.0.0.1 dev eth0 
169.254.0.0/16 dev eth0 scope link metric 1002 

And you want to add:

ip route add 192.168.100.0/24 via 10.0.47.160

The error you now would get would be different:

Error: Nexthop has invalid gateway.

In other words, you can't do this because the gateway is not local to you, it's someone else's gateway. You need an interface with a source IP that's in the same range as the gateway you're trying to connect to.

Your only source IP address (10.0.28.45) wouldn't be in the gateway's range 10.0.32.0/20, and if we allowed packets from anywhere then we could, potentially end up with all sorts of holes and loops in our network.

Conversely, how would it get back? The foreign gateway would receive a packet and send it back via it's default route because Host-A wouldn't be local to it, either.

Basically, you're asking the router to remap the source IP, but that's not applicable until it arrives at the first gateway 10.0.0.1 and, by then, it doesn't know the path to get back, since packets don't have a breadcrumb trail.

There are lots of ways to solve this problem, but it depends on the network you want. I'd look into tunnels (tap and tun) or GRE or virtual switches which do these kinds of remapping IPs and tracking foreign connections as though they were local. They create virtual interfaces in the same range as the destination, and that's how VPNs actually work.

Thankfully these solutions are a lot easier than they used to be!