3

I have two Windows environments on different subnets (192.168.1.80/30 & 172.16.21.0/25), both statically assigned with addresses connecting to a single Debian router with two NICs. I've assigned 172.16.21.1 to eth1 and 192.168.1.81 to eth2. Each Windows environment is using their respective gateway IP.

How do I allow the Windows environments to ping one other using the routing tables? I have already enabled net.ipv4.ip_forward=1 in the /etc/sysctl.conf file. I tried to use separate routing tables but my configuration didn't seem to work. Right now I've only done IP configuration on each machine, everything else is at default.

ifconfig output:

eth1      Link encap:Ethernet  HWaddr 00:0c:29:08:05:01  

          inet addr:172.16.21.1  Bcast:172.16.21.127  Mask:255.255.255.128

          inet6 addr: fe80::20c:29ff:fe08:501/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:526 errors:0 dropped:0 overruns:0 frame:0

          TX packets:562 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:44822 (43.7 KiB)  TX bytes:40642 (39.6 KiB)

          Interrupt:17 Base address:0x20a4 



eth2      Link encap:Ethernet  HWaddr 00:0c:29:08:05:0b  

          inet addr:192.168.1.81  Bcast:192.168.1.83  Mask:255.255.255.252

          inet6 addr: fe80::20c:29ff:fe08:50b/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:856 errors:0 dropped:0 overruns:0 frame:0

          TX packets:909 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:71421 (69.7 KiB)  TX bytes:85064 (83.0 KiB)

          Interrupt:17 Base address:0x2424 



lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:65536  Metric:1

          RX packets:47 errors:0 dropped:0 overruns:0 frame:0

          TX packets:47 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:4733 (4.6 KiB)  TX bytes:4733 (4.6 KiB)

Routing table (using route -n):

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

0.0.0.0         172.16.21.1     0.0.0.0         UG    0      0        0 eth1

169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth1

172.16.21.0     172.16.21.1     255.255.255.128 UG    0      0        0 eth1

192.168.1.80    192.168.1.81    255.255.255.252 UG    0      0        0 eth2

tcpdump on eth1:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
14:35:38.591460 IP 172.16.21.2 > 192.168.1.82: ICMP echo request, id 1, seq 71, length 40
14:35:43.126147 ARP, Request who-has router (00:0c:29:08:05:01 (oui Unknown)) tell 172.16.21.2, length 46
14:35:43.126189 ARP, Reply router is-at 00:0c:29:08:05:01 (oui Unknown), length 28
14:35:43.141954 IP 172.16.21.2 > 192.168.1.82: ICMP echo request, id 1, seq 72, length 40
14:36:08.894329 IP router.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
14:36:09.658277 ARP, Request who-has 199.7.91.13 tell router, length 28
14:36:10.656763 ARP, Request who-has 199.7.91.13 tell router, length 28
14:36:10.707265 IP6 fe80::20c:29ff:fe08:501.mdns > ff02::fb.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
2

To make a Linux machine to act as a router, you need to tell it how to route the traffic going from both subnets.

You need to use route command to add the routes for each subnet, somenthing like this should work:

route add -net 192.168.1.80/30 gw 192.168.1.81 dev eth2
route add -net 172.16.21.0/25 gw 172.16.21.1 dev eth1

If you have already activated net.ipv4.ip_forward=1 like you said, it should work. If you have a firewall enabled on the debian machine, you need to make the appropiate configuration on it.

  • I added the routes as you mentioned but unfortunately they didn't work. In my mind they make sense, but I can't figure out what is stopping it. My iptables is empty, both Windows machines are configured with static IPs and the correct gateways. They can also both ping the opposite gateway IPs on the router, but not one another. Would anything else be preventing the connection? – kevind Nov 23 '16 at 21:48
  • Can you paste the outputs of the ifconfig and route commands? Also you can try a tcpdump capture on the Debian and try ping from a machine in one subnet to any of the machines in the other subnet, it will show some debug information of where can be the problem. And if i understood, you said that the machines in one subnet can ping the router gateway ip of the other subnet? – Rubén Alemán Nov 23 '16 at 21:56
  • I've updated my original post to include what you've asked for. Yes, I can ping successfully from my host 172.16.21.2 to the gateway on the other subnet 192.168.1.81 and vice versa, but not 192.168.1.82 which is the other Windows host. – kevind Nov 24 '16 at 19:48
  • You have a mistake in your routing table. You only have declared one host 192.168.1.81 that is your Debian router, instead the whole subnet, like I posted before in the route command. You need to delete your actual route with route del -net 192.168.1.81/30 gw 192.168.1.81, and then execute the route command that I posted before: route add -net 192.168.1.80/30 gw 192.168.1.81 dev eth2 – Rubén Alemán Nov 24 '16 at 22:50
  • Ah my apologies for the typo. I've corrected the routing table but still no luck. Oddly enough I've also noticed that while I can ping both interfaces from the Windows clients, I cannot ping either Windows clients from the Debian router itself. – kevind Nov 28 '16 at 19:54
0

According to https://askubuntu.com/questions/95199/two-network-cards-and-ip-forwarding, forwarding from one network interface to another (say from eth0 to eth1) requires the following iptables rules

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Given that you want the forwarding work both ways, you need also to have the opposite rules:

sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.