Routing over Gateway

Question

I have a very basic question about a routing issue I have right now.

So my central server with the ip 10.0.0.1 of my own network is the router for the ip net 10.0.0.0/25. On the client 10.0.0.100 I have a WiFi connection to an access point which serves the ip net 172.20.10.0/25.

How can I add a route to 10.0.0.1 so all clients in 10.0.0.0./25 can reach 172.20.10.0/25?

---

What I have tested so far (ipv4 forwarding and iptables masquerading has been taken care of):

Adding the a route on 10.0.0.1 like

route add -net 172.20.10.0 netmask 255.255.255.128 dev br0

makes it possible on 10.0.0.1 to reach the 172.20.10.0/25 network, but thats it. A traceroute from any other client shows that the requests get stuck at 10.0.0.1 and therefore they can not reach the other network until I configure the same route on all of them individually. But this contradicts the idea of 10.0.0.1 being the gateway.

The routing table of 10.0.0.1 after using the above noted command looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         <WANIP IS HERE> 0.0.0.0         UG        0 0          0 eth0
10.0.0.0        0.0.0.0         255.255.255.128 U         0 0          0 br0
<WANIP IS HERE> 0.0.0.0         255.255.255.252 U         0 0          0 eth0
172.20.10.0     10.0.0.100      255.255.255.128 UG        0 0          0 br0

What am I missing here?

Thank you very much for your time and answers to this probably very silly issue!

Answer 1

Normally the gateway (in this case your 10.0.0.1 system) will send ICMP redirect messages to direct clients to a different gateway when it has a route to the required network via another host on the same network (i.e. 10.0.0.100 in your case).

However for that you need to add an iptables rule to allow forwarding from the internal network to the internal network, which perhaps doesn't sound logical, but actually is, as it's effectively sending traffic from the internal network to the internal network.

Add the following rule:

iptables -A FORWARD -i br0 -o br0 -j ACCEPT

Now, when a client host on your 10.0.0.0/25 network wants to access 172.20.10.x, that host sends the packet to its default gateway i.e. 10.0.0.1. That default gateway knows that the route to 172.20.10.0/25 is via 10.0.0.100, so it sends back to the client host an ICMP redirect 172.20.10.x to host 10.0.0.100 packet. The client host adds a temporary route for the target host and will use 10.0.0.100 as the gateway for that host.

The client host has to be configured to accept such ICMP redirects, as these may present a security issue when rogue redirects are sent to divert traffic to a fake gateway, however it is the default in Linux, Windows also accepts them. In Linux it can be controlled via the net.ipv4.conf.default.accept_redirects sysctl setting.

Answer 2

To the previous answer of @Wurtel I would add that you would need to also type:

echo 1 > /proc/sys/net/ipv4/ip_forward

Moreover, you have to also masquerade your connections by:

IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Otherwise the outgoing traffic will not be properly treated.