0

I am fairly new to Linux and I'm trying to test a few things on my environment.
I set up a Linux server (fedora) in order to connect 2 networks.
The server has a third natted nic (shared with my host through virtualbox).
I can successfully browse from the linux server, but if I try and ping 8.8.8.8 or similar from any client, it doesn't work.
Default route on the client is in place; iptables are allowing icmp.

What am I missing?

6
  • 3
    So you're dealing with a VM host with 3 NICs, a VM on it, two different networks and you expect us to solve anything without providing any detailed information whatsoever. What are those networks, is the VM the machine that acts as a router for outside connections? What is the network configuration of every machine mentioned? What are your routing tables? How does the VM get access to the network? Is it maybe bridged or NATed? When you say Default route on the client is in place, what is the client and does it mean that there exists a universal default route that you can be sure works? Jan 17, 2017 at 1:06
  • 2
    You have a lot of experimenting and learning ahead of you. Jan 17, 2017 at 1:08
  • Correct, the VM acts as a router. The NIC that provides internet connectivity is configured as NAT through virtualbox. The other 2 NICs are configured as internal network. They are 192.168.1.X and 192.168.2.X (standard /24 netmask). Client machines are 192.168.1.10 and 2.20
    – Dave
    Jan 17, 2017 at 1:15
  • fossil's answer might be enough to get it working, but too much information is missing to be sure. How does the traffic get routed through the VM? Does that VM act as the default gateway for the two networks? Jan 17, 2017 at 1:25
  • Yes the router is the default getaway for both networks. I am very sorry I couldn't take my laptop with me, so I'm trying to give you all the info i can remember on top of my mind. I know its not much to work with. This is going to bug me all night.
    – Dave
    Jan 17, 2017 at 1:28

2 Answers 2

2

As commented above, we could have done better with more information. The solution suggested below expects the iptables has been setup to allow in/out traffic. Anyway, you may be missing two things.

You need to explicitly allow forwarding of traffic. You need to modify /etc/sysctl.conf` add the following line.

net.ipv4.ip_forward=1

Also, you need to masquerade the outgoing traffic. Masquerading rewrites the outgoing IP address of all packets to the host having additional nic with NAT. You can enable masquerading as shown below. Watch out for the NAT interface name.

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Replace eth0 with the name of your NAT interface.

Troubleshooting Tips

  1. Ping the Linux server`s host interface address from client(s). If success, clients are able to reach the default gateway.
  2. Ping the Linux server's nat interface address from client(s). If successful, iptables firewall is allowing the ICMP traffic. If not, you need to check on iptables firewall configuration.
  3. Once you are done with above steps, the only things left out are outgoing rules and postrouting masquerade. You may have to check it out again.
6
  • Thanks fossil. Ip_forward is enabled and so is masquerade. I have added a logging rule in the iptables (to try and troubleshoot a little deeper) and I see this: ... IN = OUT SRC: 10.X.X.X DST: 8.8.8.8 prot: icmp DROP when I try pinging from one of the 2 clients. When I ping the Google DNS from the server all is good.
    – Dave
    Jan 17, 2017 at 1:23
  • 1
    Could you paste the outputs of iptables -L -n and iptables -L -n -t nat
    – fossil
    Jan 17, 2017 at 1:26
  • I would add -v to your iptables commands to get a more complete output. Jan 17, 2017 at 1:33
  • @Dave: If you see that ICMP packets are dropped, then iptables is not allowing icmp as mentioned in the question. Does browsing work? Jan 17, 2017 at 1:35
  • Browsing on the router yes, browsing on the client no. It looks like the packet is forwarded correctly from the client nic to its default getaway (router 192.168.1.x), then it reaches the nat interface through the default route on the router... but its dropped. I confirmed with a quick tcpdump I see the echo requests coming on the NAT interface on the router. But I do not understand what happens after. As soon as possible I will get you the iptables full output.
    – Dave
    Jan 17, 2017 at 1:40
1

You guys were right. I was missing the POSTROUTING masquerade and the forward as shown here below:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE 
iptables -A FORWARD -i eth0 -j ACCEPT 
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .