2

This is my first question at these boards.

I have a configuration where 4 subnets all want to communicate with each other, but each subnet needs to access the internet via its own ISP.

I have a CentOS7 Linux box with 5 NICs and I am providing a small illustration (sorry but my drawing skills are very bad)

networkconf

The 4 subnets on the right of the image (192.168.x0.0/24) need to communicate with each other. On the 5th NIC, i have created 4 virtual interfaces (eth 5.1, 5.2 etc) with a /30 subnet, that each communicates with the ISP's modem (which has the IP 192.168.1x0.253). All ISP modems are connected via a switch to Eth5.

So far I've only got to the iptables configuration (which I am not even sure is correct):

*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
:OUTPUT DROP [0:0]
-A FORWARD -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.110.252/30 -j ACCEPT
-A FORWARD -s 192.168.20.0/24 -d 192.168.120.252/30 -j ACCEPT
-A FORWARD -s 192.168.30.0/24 -d 192.168.130.252/30 -j ACCEPT
-A FORWARD -s 192.168.40.0/24 -d 192.168.140.252/30 -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.20.0/24 -i etg1 -o etg2 -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.30.0/24 -i etg1 -o etg3 -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.40.0/24 -i etg1 -o etg4 -j ACCEPT
-A FORWARD -s 192.168.20.0/24 -d 192.168.10.0/24 -i etg2 -o etg1 -j ACCEPT
-A FORWARD -s 192.168.20.0/24 -d 192.168.30.0/24 -i etg2 -o etg3 -j ACCEPT
-A FORWARD -s 192.168.20.0/24 -d 192.168.40.0/24 -i etg2 -o etg4 -j ACCEPT
-A FORWARD -s 192.168.30.0/24 -d 192.168.10.0/24 -i etg3 -o etg1 -j ACCEPT
-A FORWARD -s 192.168.30.0/24 -d 192.168.20.0/24 -i etg3 -o etg2 -j ACCEPT
-A FORWARD -s 192.168.30.0/24 -d 192.168.40.0/24 -i etg3 -o etg4 -j ACCEPT
-A FORWARD -s 192.168.40.0/24 -d 192.168.10.0/24 -i etg4 -o etg1 -j ACCEPT
-A FORWARD -s 192.168.40.0/24 -d 192.168.20.0/24 -i etg4 -o etg2 -j ACCEPT
-A FORWARD -s 192.168.40.0/24 -d 192.168.30.0/24 -i etg4 -o etg3 -j ACCEPT
COMMIT
# Completed on Sun Sep 13 17:04:45 2015
# Generated by iptables-save v1.4.21 on Sun Sep 13 17:04:45 2015
*nat
:INPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.10.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.20.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.30.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.40.0/24 -j MASQUERADE
COMMIT

My current state is that all 4 subnets (192.168.x0.0/24) can communicate with each other, all can access each isp's modem interface(eg. 192.168.10.0/24 can access 192.168.110.253), but internet traffic is not being routed through.

I am not using NetworkManager, just plain network.service. I also have enabled ip forwarding.

I am fairly sure I need to do source based routing, but I cannot for the life of me understand what I should do. Perhaps I've done this all wrong all along.

Could someone please shed some light? I am a novice in networking, I've tried Googling and search for answers prior to posting this, but to no avail.

Thanks for your time

  • This likely can be accomplished simply with a DHCP server configured to give out the desired gateway address (ISP) for each subnet. And then just route all of the local stuff to each other. – Stephen Rauch Mar 12 '17 at 0:10
  • @StephenRauch Thanks for your response. I am not too sure what you mean exactly. Each subnet has a gateway to 192.168.x0.254 set via DHCP for its interface. Changing to 192.168.1x0.254 as a gateway didn't work for me (unless that's not what you meant?) – Yiannis P. Mar 12 '17 at 13:49
  • That is what I meant, but on further reflection that is wrong, because the gateway needs to be on the local subnet. But it was also right because it is the problem. eg: When a packet arrives from 192.168.x0.x, looking for google, its destination address will not be 192.168.110.252, so your iptables will not know what to do with it. It is not immediately obvious to me how to fix it. – Stephen Rauch Mar 12 '17 at 16:29
  • @StephenRauch Do you think a virtual bridge between eth1 and eth5.1 would be possible? Wouldn't that work? – Yiannis P. Mar 13 '17 at 10:43
  • Problem with bridge in your setup is how does dhcp know which address to give to which client? I think you need a forwarding rule per internal interface that takes everything that is not for another internal interface and sends it to the appropriate gateway. – Stephen Rauch Mar 13 '17 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.