Linux nat/iptables configuration for a chain of peer-to-peer links

Question

I have an experimental setup, of 4 Linux (CentOS) machines:

All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 has access to internet.

I am trying to setup iptables rules that can allow PC1 to be able to access internet via PC4, but I have no idea how to do this.

I tried to add NAT at outgoing interface on PC2, PC3 and PC4:

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

However, this does not work, can you give me some idea how in such a setup i can make PC1 access 10.0.0.1 network??

Answer 1

First, each PC need to use the next one as gateway to the intertubes:

PC1# ip route add default via 1.1.1.2 # PC2's address where it can join PC1
PC2# ip route add default via 2.1.1.2 # PC3's address where it can join PC2
PC3# ip route add default via 3.1.1.2 # PC4's address where it can join PC3

And because it is a default route, it means that now each PC can access the next. So, now, all PC can (theoretically, if rp_filter¹ is not enabled) send packets to the next one and the internet. However, there is no return path.

For this, each PC need to be able to access all the not-directly-connected previous ones.

PC1 has no previous one, so no problem. PC2 is directly connected to PC1, so still no problem. For PC3, it need to route to PC1 via PC2:

PC3# ip route add 1.1.1.1/? via 2.1.1.1 # PC1's network via PC2
# Fill the '?' according to PC1's network mask. it should include 1.1.1.2.

Now, PC3 and PC1 should be able to ping each other. If they don't, check that PC2 has forwarding enabled (sysctl -w net.ipv4.eth?.forwarding=1 for both interfaces). Make sure that all your PC have this option set, except for PC1 where it is useless.

Now, PC4 need a route for PC2 and PC1 via PC3.

PC4# ip route add 1.1.1.1/? via 3.1.1.1 # PC1's network via PC3
PC4# ip route add 2.1.1.1/? via 3.1.1.1 # PC2's network via PC3

Now all your PC should be able to ping each other. If they don't, check your setup again and make sure forwarding is enabled.

Now, connecting to the internet should just work. if PC4 need to NAT to access the internet, then configure a NAT on PC4, without touching your routing tables.

¹ rp_filter is an option which is generally useful, but makes testing more complicated: it checks that the reverse path is correct before accepting a packet. If a packet is received from eth0 from ip 1.1.1.1, then it checks that 1.1.1.1 is routed via eth0. If it isn't the case, it rejects the packet. So rp_filter does not tolerate partially configured setups, but once your setup is complete, rp_filter can be activated and will work just fine. rp_filter is enabled by default in some linux distributions as a security measure.