0

Here is a problem: I have complete ssh access to two machines on the local intranet.
On machine two quick and reliable internet access.
I want to forward all outgoing traffic from machine PC1 via PC2 in order to speed up internet connection.

Can be this achieved with iptables? enter image description here

Here are some facts about situation

  • There is no need for PC1 to access other machines in its network or event in intranet at all
  • PC1 and PC2 can easily communicate with each other without restrictions (ping, ssh, tcp, udp)
  • I cannot use gw2 as PC1 gateway because it's on other network and inaccessible
  • I can set up both PC1 and PC2 as necessary
|improve this question
  • Can’t you use the gateway between the two networks as the default route for pc1? Would that then be forwarded to gw2 and the fast connection? That would be along the lines of #ip route add default via <gw3 ip> for that presumed gateway – Guy Jan 21 '18 at 15:46
  • @Guy actually gw1 already used to access either internet and PC2. PC2 has it's own gateway on another device eth1. – Ivan Talalaev Jan 21 '18 at 15:52
  • That seems to suggest that your fast connection to pc2 from pc1 actually goes via the slow connection to the internet. It may be useful to see ‘ip addr’ and ‘ip route show’ for pc1 and pc2 – Guy Jan 21 '18 at 16:21
  • 1
    What you want is not routing but proxying traffic. There are several way to do it. You can set up a vpn, or you can set up ssh tunnel etc. This link shows how to set up ssh tunnel digitalocean.com/community/tutorials/… – ibrahim Jan 24 '18 at 19:44
1

On PC1 do a default route via PC2:

ip route add default via <PC2-IP>

On PC2,

Allow forwarding of IPv4 packets:

sysctl net.ipv4.ip_forward = 1

Then setup IPv4 IPtables rules for forwarding and masquerading:

iptables -A FORWARD -4 -j ACCEPT This is only needed if the default policy for the FORWARD chain already is drop. Most likely it isn't if you haven't done any previous IPtables configuration.

iptables -t nat -A POSTROUTING -4 -s <PC1-IP> -j MASQUERADE

That should be enough, if you do not have any conflicting IPv4 IPtables rules on PC2.

You can check current IPv4 IPtables rules with:

iptables -vnL

iptables -t nat -vnL

|improve this answer
  • guys, are you kidding? Both PCs in completely different subnetworks. Between them several routers and firewalls. This is not possible simply to add as default node. RTNETLINK answers: Network is unreachable – Ivan Talalaev Jan 22 '18 at 11:16
  • @IvanTalalaev ip route add <subnet2> via <gateway between subnet1 and subnet 2> Then add default maybe. – Guy Jan 23 '18 at 20:01
0

This is about routing. Just make PC2 the default gateway for PC1. In addition you (probably) have to use iptables for configuring SNAT on PC2 so that gw2 sends the reply packets to PC2.

It gets more complicated if you want to use the slow internet connection in addition to the fast one.

|improve this answer
  • So how can I do that? As you can see that PC1 and PC2 located in completely different networks bind each own gateways. As I know iptables suppose to have gateway in direct access from the device in the same subnetwork. link – Ivan Talalaev Jan 21 '18 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.