1

The environment is FreeBSD for the most part and looks like this:

HOST_A <-> ROUTER <-> LOKI <-> HOST_B

Minimally, I would like to be able to ping ROUTER from HOST_B.

  • ROUTER is assigned the IP 10.0.0.1
  • LOKI is a multi-homed machine that is assigned IPs 10.0.0.2 and 192.168.200.1
  • HOST_B is assigned the IP 192.168.200.3
  • HOST_A is assigned the IP 10.0.0.3

I have set the network up as above and added gateway_enable="YES" to loki's rc.conf

netstat -r on LOKI produces:

Routing tables
Internet:
Destination        Gateway            Flags      Netif Expire
default            10.0.0.1           UGS         em0
10.0.0.0           link#1             U           em0
10.0.0.2           link#1             UHS         lo0
loki               link#2             UH          lo0
192.168.200.0      link#3             U           ue0
192.168.200.1      link#3             UHS         lo0

which looks like a fine routing table and appears to work in all directions.

netstat -r on HOST_B produces:

Routing tables
Internet:
Destination        Gateway            Flags      Netif Expire
default            192.168.200.1      UGS         em0
hostb              link#2             UH          lo0
192.168.200.0      link#1             U           em0
192.168.200.3      link#1             UHS         lo0

which looks like another fine routing table, but is only able to see LOKI.

In summary:

  • LOKI is able to ping HOST_A, HOST_B and ROUTER
  • HOST_B is able to ping LOKI, but not ROUTER or HOST_A

Some additional notes: from HOST_B

ping 10.0.0.1 100% packet loss

In wireshark on LOKI, while pinging 10.0.0.1 from HOST_B:

120 40.549564000    192.168.200.3   10.0.0.1    ICMP    98  Echo (ping) request  id=0x5a0e, seq=92/23552, ttl=63 (no response found!)

It appears to me that nothing is being routed from LOKI to ROUTER. What am I missing?

I confirmed that IP forwarding was taking place by commenting out gateway_enable="YES" in /etc/rc.conf and rebooting.

Then, I ran the following commands on loki:

sudo tcpdump -i em0 -nS
sudo tcpdump -i ue0 -nS

to monitor activity on the two nics.

from hostb, I ran:

ping 10.0.0.1

the ue0 interface on 192.168.200.1 reported:

14:44:21.870865 IP 192.168.200.3 > 10.0.0.1: ICMP echo request, id 21509, seq 0, length 64

nothing was reported on the em0 interface on 10.0.0.2.

I then ran:

sudo sysctl -w net.inet.ip.forwarding=1

and sure enough, em0 reported:

14:58:14.745369 IP 192.168.200.3 > 10.0.0.1: ICMP echo request, id 25861, seq 0, length 64

But no, reply such as what I get with a ping loki from hostb:

14:44:15.724200 IP 192.168.200.3 > 192.168.200.1: ICMP echo request, id 21253, seq 4, length 64
14:44:15.724207 IP 192.168.200.1 > 192.168.200.3: ICMP echo reply, id 21253, seq 4, length 64

If I ping router from loki, all is fine:

15:04:55.637839 IP 10.0.0.2 > 10.0.0.1: ICMP echo request, id 46852, seq 3, length 64
15:04:55.638324 IP 10.0.0.1 > 10.0.0.2: ICMP echo reply, id 46852, seq 3, length 64

Any ideas how to find the reply?

2

Why are LOKI and HOST_A connected by a router when they are on the same subnet? Is it really a router, or is it just a switch? (From your later comments, although the device is a router, it is just acting as a switch between LOKI and HOST_A).

What is the routing table on HOST_A and ROUTER? If it were to try to reach 192.168.200.1, why should it use LOKI as a destination?

Unless the routing table on these devices know to use LOKI for the 192 subnet, they will just forward to the default gateway.

As an alternative, you might want to investigate installing NAT on LOKI. For many services, it can encapsulate traffic from HOST_B as traffic from LOKI. Since other machines can get to there, it can receive the traffic and forward back to HOST_B.

  • It's a router with a wan port and 4 lan ports. HOST_A and LOKI are plugged into 2 of the lan ports on the switch. At this point, I am looking at HOST_B being able to see either HOST_A or ROUTER, not the other direction. If I only want HOST_B to be able to see ROUTER, is it necessary for ROUTER to have a route to HOST_B as well (through LOKI)? – decuser Nov 6 '15 at 22:48
  • "see" implies bidirection. Packets from HOST_A may be making to ROUTER, but it doesn't know how to send the reply back. Yes, it's necessary for it to have a valid route back. – BowlOfRed Nov 6 '15 at 22:50
  • If you can't get a real routing table set on your ROUTER, you could consider setting up NAT on LOKI and having it forward packets to HOST_B that way. It's more limiting than full routing, but is usable in cases where you can't get the routing tables updated in the rest of the network. – BowlOfRed Nov 6 '15 at 22:52
  • I am beginning to understand the problem. Is this what NAT is for? If I am not using NAT, then ROUTER needs a static route set up with LOKI as the gateway for 192.168.200.X/? – decuser Nov 6 '15 at 22:53
  • Yes, NAT rewrites the packets as coming from LOKI (which the router does know how to reach), then forwards them on to HOST_B. Otherwise ROUTER needs a route (static or otherwise) to correctly reach the 192 network via LOKI. – BowlOfRed Nov 6 '15 at 22:59
1

It seems to me that LOKI is doing exactly what you expect. It received a ping request packet on ue0 and relays it to em0. If it received a ping reply on em0, it would relay it to ue0.

The problem is ROUTER. It receives a ping request from 192.168.200.3 on its LAN side (but that doesn't matter). When it sends a ping reply to 192.168.200.3, it looks at it's routing table. LAN side is 10.0.0.0/24 (or similar) so the reply packet is sent to the ROUTER's default gateway, which is WAN side on the public Internet.

The ROUTER uses network address translation (NAT) to fake a 10.0.0.0/24 network behind your one true public IP address (assigned to the WAN side of the ROUTER, by your ISP). The RFC1918 addresses are private and cannot be exposed to the public Internet, and will always live behind NAT.

You could place a static route into ROUTER to make your ping experiment work, but that will still be isolated from the public Internet. You could enable NAT on LOKI, in which case you have double-NAT to the Internet (which works fine, but fairly pointless). If you just need a second level firewall you might consider making LOKI a bridging firewall and running 10.0.0.0/24 on both NICs. If you want to host internet-facing services, and you only have one public IP address, you are forced to use port-forwarding rules on ROUTER.

0

Something has to be set to forward packets from Network A to Network B. Loki, being dual homed, could do this, but it is not automatic. In doing so, you'll be setting Loki up as a router, and should use Loki as the default gateway for Host B. Another option is to set a permanent route in Host B's routing table specifying Loki as the destination for 10.x.x.x traffic.

  • I set gateway_enable="YES" in rc.conf on loki, is another step required to forward the packets? – decuser Nov 6 '15 at 19:13
  • That is a good question that I do not know the answer to. – Xalorous Nov 6 '15 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.