2

I'm trying to connect two LANs using a ppp link. I had a basic network topology diagram but it didn't come out well. This can be seen here.

Routing Problem
================


172.20.0.0/16                                 192.168.2.0/24
              eth1  +-----------------+ eth0                                                  
  172.20.0.1 |======|      Ubuntu     |======| 192.168.2.231
                    |                 |
                    |      Router     |======| 192.168.254.253    192.168.254.254 |=====> To: 172.30.0.0/16
                    +-----------------+ ppp0

All computers in the 172.20.0.0/16 subnet can access the internet via eth0. All devices on the 172.20.0.0/16 subnet use 172.20.0.1 as their gateway. When I ping any device on the 172.30.0.0/16 subnet from a device on the 172.20.0.0/16 subnet, I see that nothing is getting across from eth1 to ppp0. The way I tested this was by pinging from a device on the 172.20.0.0/16 subnet( ping -s 10240 172.30.0.9 ) and checking all three interfaces on the router using tcpdump( tcpdump -vv -x -X -s 1500 -i eth1 ). I'm not seeing any ICMP packets on any of these interfaces. I suspect the problem is with iptables.

Configurations on the Ubuntu Router looks like this:

ip route show
default via 192.168.2.1 dev eth0 
172.20.0.0/16 dev eth1  proto kernel  scope link  src 172.20.0.1 
172.30.0.0/16 dev ppp0  scope link 
172.30.0.0/16 via 192.168.250.254 dev ppp0 
192.168.2.0/24 dev eth0  proto kernel  scope link  src 192.168.2.231 
192.168.250.254 dev ppp0  proto kernel  scope link  src 192.168.250.253


cat /proc/sys/net/ipv4/ip_forward 
1
cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
1
cat /proc/sys/net/ipv4/conf/eth0/forwarding
1
cat /proc/sys/net/ipv4/conf/eth1/forwarding
1


iptables --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o ppp0 -j ACCEPT
-A FORWARD -i ppp0 -o eth1 -j ACCEPT

iptables -t nat --list-rules
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A PREROUTING -d 192.168.250.254/32 -j DNAT --to-destination 172.30.0.1
-A POSTROUTING -o eth1 -j SNAT --to-source 172.20.0.1

I should add I've tried many different combinations of iptables rules, as well as trying different routing options.

1

First, the filter rules are somehow redundant. When you never drop and your policy is ACCEPT, adding some more ACCEPT rules has no point. No package will be filtered.

The way I tested this was by pinging from a device on the 172.20.0.0/16 subnet( ping -s 10240 172.30.0.9 )

I never actually tried to send huge ping blocks of 10kByte through a network and I don't know why you do that, but a standard ping package of 56 bytes should perfectly do, to check connection and might not suffer from MTU fragmentation issues.

and checking all three interfaces on the router using tcpdump( tcpdump -vv -x -X -s 1500 -i eth1 ).

Of course when you check with tcpdump -i eth1 ... you check only eth1 but that's trivial.

As there is no filter rule, there should be no problem with iptables. At least there should be some input on some interface.

Have you checked your routing where you send your ping from?

I don't get the idea behind the rule

-A PREROUTING -d 192.168.250.254/32 -j DNAT --to-destination 172.30.0.1

In words, packages that are addressed to 192.168.250.254, so all packages that are somehow want to go out through ppp0, will be rewritten to go to 172.30.0.1, which should be ppp0 too (not clear!). Later in the routing stage any package that goes to the ppp0 subnet 172.30.0.0/16 will be routed to 192.168.250.254. This rule looks useless to me if not destructive.

When you send packages to 172.30.0.9 or any 172.30.0.0/16 you might want to -j MASQUERADE when they leave, that the destination knows where to answer, though it doesn't know how to route.

`iptables -t nat -A POSTROUTING -s 172.20.0.0/16 -i ppp0 -j MASQUERADE`

But that will not solve the problem that you don't see any ping package on any interface of your router.

My first attempt would be, to see the ping packages leave the system I send them from, with tcpdump on that system.

`tcpdump -i eth0 'icmp'

or only packages that should to over ppp0

`tcpudmp -i eth0 'net 172.30.0.0/16'

assuming that the 172.20.0.0/16 hosts, that are not your router, only have one interface named eth0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.