Discussion:
Basic routing
John Smithee
2014-10-04 01:10:58 UTC
Permalink
Hi,

I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.

The first network has a gateway to other networks behind it,
it can reach all networks well, incl. the first network.

The second network can reach the first, but reaching anything
beyond (ie. the other networks behind the first network) is
somehow not possible.

Only IPv4 is used, and IP forwarding on the machine is enabled (ie.
net.ipv4.ip_forward=1 in /etc/sysctl.conf).

Is this a classical routing issue or has this to be done via iptables?

I rather would like to keep the original IPs in the packet headers,
ie. not use NAT, and also not use bridging.
How can this be done?

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Smithee
2014-10-04 01:24:17 UTC
Permalink
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
The first network has a gateway to other networks behind it,
it can reach all networks well, incl. the first network.
The second network can reach the first, but reaching anything
beyond (ie. the other networks behind the first network) is
somehow not possible.
Only IPv4 is used, and IP forwarding on the machine is enabled (ie.
net.ipv4.ip_forward=1 in /etc/sysctl.conf).
Is this a classical routing issue or has this to be done via iptables?
I rather would like to keep the original IPs in the packet headers,
ie. not use NAT, and also not use bridging.
How can this be done?
Here's some more info:


# /etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.68.22
netmask 255.255.255.0
broadcast 192.168.68.255
gateway 192.168.68.254

auto eth1
allow-hotplug eth1
iface eth1 inet static
address 192.168.69.22
netmask 255.255.255.0
broadcast 192.168.69.255



# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.68.254 0.0.0.0 UG 0 0 0 eth0
link-local * 255.255.0.0 U 1 0 0 eth0
192.168.68.0 * 255.255.255.0 U 1 0 0 eth0
192.168.69.0 * 255.255.255.0 U 0 0 0 eth1



Pinging the external gateway (192.168.68.254) from eth0 works fine,
but not from eth1:

# ping -I eth1 192.168.68.254
PING 192.168.68.254 (192.168.68.254) from 192.168.69.22 eth1: 56(84) bytes of
data.
From 192.168.69.22 icmp_seq=1 Destination Host Unreachable
From 192.168.69.22 icmp_seq=2 Destination Host Unreachable
From 192.168.69.22 icmp_seq=3 Destination Host Unreachable
^C
--- 192.168.68.254 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4022ms



--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
George Botye
2014-10-04 08:50:45 UTC
Permalink
Post by John Smithee
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
The first network has a gateway to other networks behind it,
it can reach all networks well, incl. the first network.
The second network can reach the first, but reaching anything
beyond (ie. the other networks behind the first network) is
somehow not possible.
Only IPv4 is used, and IP forwarding on the machine is enabled (ie.
net.ipv4.ip_forward=1 in /etc/sysctl.conf).
Is this a classical routing issue or has this to be done via iptables?
I rather would like to keep the original IPs in the packet headers,
ie. not use NAT, and also not use bridging.
How can this be done?
# /etc/network/interfaces
auto lo
iface lo inet loopback
auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.68.22
netmask 255.255.255.0
broadcast 192.168.68.255
gateway 192.168.68.254
auto eth1
allow-hotplug eth1
iface eth1 inet static
address 192.168.69.22
netmask 255.255.255.0
broadcast 192.168.69.255
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
default 192.168.68.254 0.0.0.0 UG 0 0 0 eth0
link-local * 255.255.0.0 U 1 0 0 eth0
192.168.68.0 * 255.255.255.0 U 1 0 0 eth0
192.168.69.0 * 255.255.255.0 U 0 0 0 eth1
Pinging the external gateway (192.168.68.254) from eth0 works fine,
# ping -I eth1 192.168.68.254
PING 192.168.68.254 (192.168.68.254) from 192.168.69.22 eth1: 56(84)
bytes of data.
From 192.168.69.22 icmp_seq=1 Destination Host Unreachable
From 192.168.69.22 icmp_seq=2 Destination Host Unreachable
From 192.168.69.22 icmp_seq=3 Destination Host Unreachable
^C
--- 192.168.68.254 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4022ms
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
More majordomo info at http://vger.kernel.org/majordomo-info.html
.
Hi,

Drawing always helps you... :-)

eth0 eth1
| |
V V
--------------------- ---------------------
| 192.168.68.0 | <---???---> | 192.168.69.0 |
--------------------- ---------------------

Please imagine what happen with packet addressed to 192.168.68.254 in
192.168.69.0/24.
(I suggest read this http://www.tldp.org/LDP/nag2/nag2.pdf)

Regards, George
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Neal Murphy
2014-10-04 01:34:59 UTC
Permalink
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.

The prime directive: every router must have explicit routes to all networks it
can reach, except that the default route can eliminate many explicit routes.
In other words, "These routes specify how to reach these LANs; packets for all
other networks will be sent via the default route if it exists. Packets for
which there is no route will be dribbled into the bit bucket." Note the phrase
"every router"; it include all of your internal routers as well as your
perimeter (default) gateway.

For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via 192.168.68.X and
explicit routes to networks reachable via 192.168.69.Y, where the X and Y
addresses are the addresses of the routers that are gateways to those other
LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----

If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this address).
----
ip route add default via 192.168.68.254
----
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Smithee
2014-10-04 02:52:06 UTC
Permalink
Post by Neal Murphy
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.
The prime directive: every router must have explicit routes to all networks it
can reach, except that the default route can eliminate many explicit routes.
In other words, "These routes specify how to reach these LANs; packets for all
other networks will be sent via the default route if it exists. Packets for
which there is no route will be dribbled into the bit bucket." Note the phrase
"every router"; it include all of your internal routers as well as your
perimeter (default) gateway.
For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via 192.168.68.X and
explicit routes to networks reachable via 192.168.69.Y, where the X and Y
addresses are the addresses of the routers that are gateways to those other
LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----
If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this address).
----
ip route add default via 192.168.68.254
----
Thx, yes this is indeed standard IP networking stuff, but unfortunately
it still isn't working; there must be something more to it.

I think the ping error text is perhaps misleading: I guess the ping request
does reach the destination, but the answer packet from the ping reply
gets not forwarded to the originating second interface eth1 (192.168.69.*).

Ie. the the request from eth1 correctly goes out thru the eth0 interface
and the reply comes as well over the same eth0 interface,
but there is on the return path something missing to forward it from
eth0 to eth1. Isn't it?



--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Dennis Jacobfeuerborn
2014-10-04 03:05:39 UTC
Permalink
Post by John Smithee
Post by Neal Murphy
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.
The prime directive: every router must have explicit routes to all networks it
can reach, except that the default route can eliminate many explicit routes.
In other words, "These routes specify how to reach these LANs; packets for all
other networks will be sent via the default route if it exists. Packets for
which there is no route will be dribbled into the bit bucket." Note the phrase
"every router"; it include all of your internal routers as well as your
perimeter (default) gateway.
For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via
192.168.68.X and
explicit routes to networks reachable via 192.168.69.Y, where the X and Y
addresses are the addresses of the routers that are gateways to those other
LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----
If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this address).
----
ip route add default via 192.168.68.254
----
Thx, yes this is indeed standard IP networking stuff, but unfortunately
it still isn't working; there must be something more to it.
I think the ping error text is perhaps misleading: I guess the ping request
does reach the destination, but the answer packet from the ping reply
gets not forwarded to the originating second interface eth1 (192.168.69.*).
Ie. the the request from eth1 correctly goes out thru the eth0 interface
and the reply comes as well over the same eth0 interface,
but there is on the return path something missing to forward it from
eth0 to eth1. Isn't it?
Have you tried doing a tcpdump on eth0 while the ping is running to see
if packets are actually leaving the system and/or returning?

Regards,
Dennis

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Neal Murphy
2014-10-04 05:02:28 UTC
Permalink
Post by John Smithee
Post by Neal Murphy
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.
The prime directive: every router must have explicit routes to all
networks it can reach, except that the default route can eliminate many
explicit routes. In other words, "These routes specify how to reach
these LANs; packets for all other networks will be sent via the default
route if it exists. Packets for which there is no route will be dribbled
into the bit bucket." Note the phrase "every router"; it include all of
your internal routers as well as your perimeter (default) gateway.
For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via 192.168.68.X
and explicit routes to networks reachable via 192.168.69.Y, where the X
and Y addresses are the addresses of the routers that are gateways to
those other LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----
If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this
address). ----
ip route add default via 192.168.68.254
----
Thx, yes this is indeed standard IP networking stuff, but unfortunately
it still isn't working; there must be something more to it.
I think the ping error text is perhaps misleading: I guess the ping request
does reach the destination, but the answer packet from the ping reply
gets not forwarded to the originating second interface eth1 (192.168.69.*).
Ie. the the request from eth1 correctly goes out thru the eth0 interface
and the reply comes as well over the same eth0 interface,
but there is on the return path something missing to forward it from
eth0 to eth1. Isn't it?
Actually, your ping (below) works correctly. '-I eth1' tells ping to send the
packet out that interface; linux doesn't know where to send the packet on that
IF and correctly says the host is unreachable. (Technically, it send ARP
requests out but gets no response, as expected.)

Use 'ping -I 192.168.69.22' to use that address on pings going out the other
IF.
Post by John Smithee
auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.68.22
netmask 255.255.255.0
broadcast 192.168.68.255
gateway 192.168.68.254
auto eth1
allow-hotplug eth1
iface eth1 inet static
address 192.168.69.22
netmask 255.255.255.0
broadcast 192.168.69.255
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
Post by John Smithee
default 192.168.68.254 0.0.0.0 UG 0 0 0 eth0
link-local * 255.255.0.0 U 1 0 0 eth0
192.168.68.0 * 255.255.255.0 U 1 0 0 eth0
192.168.69.0 * 255.255.255.0 U 0 0 0 eth1
Pinging the external gateway (192.168.68.254) from eth0 works fine,
# ping -I eth1 192.168.68.254
PING 192.168.68.254 (192.168.68.254) from 192.168.69.22 eth1: 56(84) bytes
of
Post by John Smithee
data.
From 192.168.69.22 icmp_seq=1 Destination Host Unreachable
From 192.168.69.22 icmp_seq=2 Destination Host Unreachable
From 192.168.69.22 icmp_seq=3 Destination Host Unreachable
^C
--- 192.168.68.254 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4022ms
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Lister
2014-10-04 07:04:14 UTC
Permalink
Post by John Smithee
Post by Neal Murphy
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.
The prime directive: every router must have explicit routes to all networks it
can reach, except that the default route can eliminate many explicit routes.
In other words, "These routes specify how to reach these LANs; packets for all
other networks will be sent via the default route if it exists. Packets for
which there is no route will be dribbled into the bit bucket." Note the phrase
"every router"; it include all of your internal routers as well as your
perimeter (default) gateway.
For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via
192.168.68.X and
explicit routes to networks reachable via 192.168.69.Y, where the X and Y
addresses are the addresses of the routers that are gateways to those other
LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----
If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this address).
----
ip route add default via 192.168.68.254
----
Thx, yes this is indeed standard IP networking stuff, but unfortunately
it still isn't working; there must be something more to it.
I think the ping error text is perhaps misleading: I guess the ping request
does reach the destination, but the answer packet from the ping reply
gets not forwarded to the originating second interface eth1
(192.168.69.*).
Ie. the the request from eth1 correctly goes out thru the eth0 interface
and the reply comes as well over the same eth0 interface,
but there is on the return path something missing to forward it from
eth0 to eth1. Isn't it?
You are trying to ping an address on eth0 using eth1, in otherwords you
are saying the traffic MUST leave on eth1 and somehow find its way to
eth0. The destination host unreachable is the return packet saying that
this is impossible. You probably have no route setup to direct traffic
from 69.x to 68.x and I suspect even with one it would fail as by using
-I with ping you are forcing the output network device. Generally you
would use -I if there were 2 routes to an external device to test both
are working, in this instance the routing is internal but you are
telling ping it needs to transmit the packet.

If you really want to do this, you could add some ip tables rules to
intercept traffic on eth1 going to 68.x and switch the source
interface/address

John
Post by John Smithee
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Smithee
2014-10-04 11:06:41 UTC
Permalink
Post by John Smithee
Post by Neal Murphy
Post by John Smithee
Hi,
I've 2 NICs on a machine, both attached to seperate networks
(192.168.68.0/24 and 192.168.69.0/24). I'm trying to set up a
basic gateway (or routing?) between the two networks.
Is this a classical routing issue or has this to be done via iptables?
Standard networking, standard routing. Netfilter doesn't enter the equation.
The prime directive: every router must have explicit routes to all networks it
can reach, except that the default route can eliminate many explicit routes.
In other words, "These routes specify how to reach these LANs; packets for all
other networks will be sent via the default route if it exists. Packets for
which there is no route will be dribbled into the bit bucket." Note the phrase
"every router"; it include all of your internal routers as well as your
perimeter (default) gateway.
For a router to transmit a packet it must know *where* to send it. Your
machine must have explicit routes to networks reachable via 192.168.68.X and
explicit routes to networks reachable via 192.168.69.Y, where the X and Y
addresses are the addresses of the routers that are gateways to those other
LANs.
----
ip route add 10.20.30.0/24 via 192.168.69.34
ip route add 192.168.128.0/17 via 192.168.68.200
etc.
----
If your 'internetwork' includes the universe (the Internet), you need a
default route (send all packets I don't have a route for to this address).
----
ip route add default via 192.168.68.254
----
Thx, yes this is indeed standard IP networking stuff, but unfortunately
it still isn't working; there must be something more to it.
I think the ping error text is perhaps misleading: I guess the ping request
does reach the destination, but the answer packet from the ping reply
gets not forwarded to the originating second interface eth1 (192.168.69.*).
Ie. the the request from eth1 correctly goes out thru the eth0 interface
and the reply comes as well over the same eth0 interface,
but there is on the return path something missing to forward it from
eth0 to eth1. Isn't it?
You are trying to ping an address on eth0 using eth1, in otherwords you are
saying the traffic MUST leave on eth1 and somehow find its way to eth0. The
destination host unreachable is the return packet saying that this is
impossible. You probably have no route setup to direct traffic from 69.x to
68.x and I suspect even with one it would fail as by using -I with ping you
are forcing the output network device. Generally you would use -I if there
were 2 routes to an external device to test both are working, in this instance
the routing is internal but you are telling ping it needs to transmit the packet.
If you really want to do this, you could add some ip tables rules to intercept
traffic on eth1 going to 68.x and switch the source interface/address
John
Ok, I admit using "ping -I" was a bad example. The whole point I tried
to make is, that the second net (69.0) cannot reach any other IP outside its
own net.
The goal is to let 69.0 reach the world via this gateway machine 68.22/69.22.
Is some iptables needed in this case?


--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Thomas Bätzler
2014-10-04 13:56:50 UTC
Permalink
Hi,
Ok, I admit using "ping -I" was a bad example. The whole point I trie=
d
to make is, that the second net (69.0) cannot reach any other IP
outside its own net.
The goal is to let 69.0 reach the world via this gateway machine 68.22/69.22.
Is some iptables needed in this case?
You do have IP forwarding enabled?

If not, enable it using
echo "1" > /proc/sys/net/ipv4/ip_forward
and try again.


HTH,
Thomas

--=20
BRINGE Informationstechnik GmbH
Zur Seeplatte 12
D-76228 Karlsruhe
Germany

=46on: +49 721 94246-0
=46on: +49 171 5438457
=46ax: +49 721 94246-66
Web: http://www.bringe.de/

Gesch=E4ftsf=FChrer: Dipl.-Ing. (FH) Martin Bringe
Ust.Id: DE812936645, HRB 108943 Mannheim


---
Diese E-Mail ist frei von Viren und Malware, denn der avast! Antivirus =
Schutz ist aktiv.
http://www.avast.com

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Smithee
2014-10-04 15:07:44 UTC
Permalink
Post by Thomas Bätzler
Hi,
Ok, I admit using "ping -I" was a bad example. The whole point I tri=
ed
Post by Thomas Bätzler
to make is, that the second net (69.0) cannot reach any other IP
outside its own net.
The goal is to let 69.0 reach the world via this gateway machine 68.22/69.22.
Is some iptables needed in this case?
You do have IP forwarding enabled?
If not, enable it using
echo "1" > /proc/sys/net/ipv4/ip_forward
and try again.
HTH,
Thomas
Yes, ip frowarding is enabled.

After doing much research on the net and experimenting
I think (still testing) I finally found a solution,
but it's unfortunately a little bit complicated.
I'll summarize later.



--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Smithee
2014-10-04 17:44:46 UTC
Permalink
Post by John Smithee
Post by Thomas Bätzler
Hi,
Ok, I admit using "ping -I" was a bad example. The whole point I tr=
ied
Post by John Smithee
Post by Thomas Bätzler
to make is, that the second net (69.0) cannot reach any other IP
outside its own net.
The goal is to let 69.0 reach the world via this gateway machine 68.22/69.22.
Is some iptables needed in this case?
You do have IP forwarding enabled?
If not, enable it using
echo "1" > /proc/sys/net/ipv4/ip_forward
and try again.
HTH,
Thomas
Yes, ip frowarding is enabled.
After doing much research on the net and experimenting
I think (still testing) I finally found a solution,
but it's unfortunately a little bit complicated.
I'll summarize later.
I finally managed to get it working with these steps:

IF0=3D"eth0"
NW0=3D"192.168.68.0/24"
ET0=3D"192.168.68.22"
GW0=3D"192.168.68.254"
TAB0=3D"my0" # must be defined in /etc/iproute2/rt_tables, f.e. 100 my=
0

IF1=3D"eth1"
NW1=3D"192.168.69.0/24"
ET1=3D"192.168.69.22"
GW1=3D"192.168.69.7"
TAB1=3D"my1" # must be defined in /etc/iproute2/rt_tables, f.e. 101 my=
1

ip route add $NW0 dev $IF0 src $ET0 table $TAB0
ip route add default via $GW0 table $TAB0

ip route add $NW1 dev $IF1 src $ET1 table $TAB1
ip route add default via $GW1 table $TAB1

ip route add $NW0 dev $IF0 src $ET0
ip route add $NW1 dev $IF1 src $ET1

# your preference for default route:
ip route add default via $GW0

ip rule add from $ET0 table $TAB0
ip rule add from $ET1 table $TAB1
ip rule add to $ET0 table $TAB0
ip rule add to $ET1 table $TAB1

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


This solution is not that bad, though IMHO complicated.
But one thing is still missing: 69.* cannot ping
the IP 68.22, but other than that it can reach everything else.

If someone knows a simpler solution pls let me know, thx.


Here are some references where I found the above stuff:

http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-r=
outes-in-linux/
http://www.linuxhorizon.ro/iproute2.html
http://www.lartc.org/howto/lartc.rpdb.html
http://www.lartc.org/howto/lartc.rpdb.multiple-links.html




--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
John Lister
2014-10-05 15:41:25 UTC
Permalink
Post by John Smithee
Post by John Smithee
Post by Thomas Bätzler
Hi,
Ok, I admit using "ping -I" was a bad example. The whole point I t=
ried
Post by John Smithee
Post by John Smithee
Post by Thomas Bätzler
to make is, that the second net (69.0) cannot reach any other IP
outside its own net.
The goal is to let 69.0 reach the world via this gateway machine 68.22/69.22.
Is some iptables needed in this case?
You do have IP forwarding enabled?
If not, enable it using
echo "1" > /proc/sys/net/ipv4/ip_forward
and try again.
HTH,
Thomas
Yes, ip frowarding is enabled.
After doing much research on the net and experimenting
I think (still testing) I finally found a solution,
but it's unfortunately a little bit complicated.
I'll summarize later.
IF0=3D"eth0"
NW0=3D"192.168.68.0/24"
ET0=3D"192.168.68.22"
GW0=3D"192.168.68.254"
TAB0=3D"my0" # must be defined in /etc/iproute2/rt_tables, f.e. 100 =
my0
Post by John Smithee
IF1=3D"eth1"
NW1=3D"192.168.69.0/24"
ET1=3D"192.168.69.22"
GW1=3D"192.168.69.7"
TAB1=3D"my1" # must be defined in /etc/iproute2/rt_tables, f.e. 101 =
my1
Post by John Smithee
ip route add $NW0 dev $IF0 src $ET0 table $TAB0
ip route add default via $GW0 table $TAB0
ip route add $NW1 dev $IF1 src $ET1 table $TAB1
ip route add default via $GW1 table $TAB1
ip route add $NW0 dev $IF0 src $ET0
ip route add $NW1 dev $IF1 src $ET1
ip route add default via $GW0
ip rule add from $ET0 table $TAB0
ip rule add from $ET1 table $TAB1
ip rule add to $ET0 table $TAB0
ip rule add to $ET1 table $TAB1
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
This solution is not that bad, though IMHO complicated.
But one thing is still missing: 69.* cannot ping
the IP 68.22, but other than that it can reach everything else.
If someone knows a simpler solution pls let me know, thx.
http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default=
-routes-in-linux/=20
Post by John Smithee
http://www.linuxhorizon.ro/iproute2.html
http://www.lartc.org/howto/lartc.rpdb.html
http://www.lartc.org/howto/lartc.rpdb.multiple-links.html
This seems overly complicated for what sounds like a simple routing=20
solution. I'm guessing there must be something slightly out of the=20
ordinary about your setup or I'm mising something. I'm assuming=20
something like this


MACHINE1-x.69.7 ----> .69.22 - MACHINE2 - .68.22 ----> .68.254 -=20
DEFAULT ROUTER --> internet


the routing table for machine1 should be
default 192.168.69.22 0.0.0.0 eth0
192.168.69.0 * 255.255.255.0 eth0

and for machine2 is should be
default 192.168.68.254 0.0.0.0 eth0
192.168.68.0 * 255.255.255.0 eth0
192.168.69.0 * 255.255.255.0 eth1


The only issue you have is that there either needs to be a route on you=
r=20
external router to 192.68.69.0/24 via 192.168.68.22 or as you have it=20
above an iptables rule to masquerade any address on the 192.168.69=20
domain to the eth0 address so that the replies from outside your networ=
k=20
know how to get back to your private subnet.

John
Post by John Smithee
--=20
To unsubscribe from this list: send the line "unsubscribe netfilter" =
in
Post by John Smithee
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
André Paulsberg
2014-10-06 09:41:43 UTC
Permalink
: If someone knows a simpler solution pls let me know, thx.

SHORT answer , I think you forgot return routing !
I am not sure what you are doing here , but I am sure from your last po=
st you are "doin' it wrong" .
If I understand your solution , you have now "eliminated the need" for =
routing by using NAT !

Since I cannot see your complete setup I will explain some BASIC "issue=
s" you might encounter .
( And I believe this might be your issue for this case too )=20


NET A --- A side GW-X (ROUTER) B side GW-X --- NET B --- B side GW-Y =
(ROUTER) C side GW-Y --- Internet/or further networks
SWITCH SWITCH =20
| |
PC-A1 PC-B1
PC-A2 PC-B2


To start on the solution , the first thing we focus on is ROUTING is al=
ways 2 ways .
In any setup like above , making a route from GW-X is useless ,
unless all units "after" GW-X know a route back to side A for the NET A=
.

When GW's already have routing enabled , they normally only have 1 rout=
e entry added .
This is default GW going towards outside world , additionally they also=
have automatic
"routing" for all local interfaces .
When you have this traffic will only go from "left to right" , meaning =
when you send packets from
A to B , the B will send any reply out to C , because it will follow de=
fault route going "right" .
MINIMUM to solve this is to make a route for NET A on GW-Y to GW-X .

Now A will send to B and B return packets to A through GW-Y router ,
this is somewhat suboptimal since only unit on NET B with route to A IS=
GW-Y .
( meaning all traffic to NET A must initially go through GW-Y , making =
an extra HOP for PC's in NET B )
Next step is to solve this by either adding a route for all units , her=
e seen as PC-B1 and PC-B2 ,
So that they send traffic directly to GW-X for NET-A and have default r=
oute to GW-Y .
( This can also be done via routing protocols like RIP , OSPF or IS-IS =
, but for home use you will likely add one more route )

Your next issue will be fix RFC1918 ( private address space ) when goin=
g to Internet ( or any other outside network )
This is usually fixed by adding NAT for all networks to the address of =
GW-Y's IP on NET C when leaving GW-Y towards outside .
This must include in this examples NET A and NET B , if not no one on t=
he outside will be able to return packets=20
( this also means that GW-Y IP on NET C needs to be public and also rou=
ted , which is normaly the responsibility of your ISP )


Hope this explains how to start your setup from scratch again , if not =
please ask if you need more info .


Best regards
Andr=E9 Paulsberg
Senior Network Engineer=20
Core Network
Operation, Network, Nordic Operations
***@evry.com
M +47 9070 5988

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Loading...