0

I have a very basic question about a routing issue I have right now.

So my central server with the ip 10.0.0.1 of my own network is the router for the ip net 10.0.0.0/25. On the client 10.0.0.100 I have a WiFi connection to an access point which serves the ip net 172.20.10.0/25.

How can I add a route to 10.0.0.1 so all clients in 10.0.0.0./25 can reach 172.20.10.0/25?


What I have tested so far (ipv4 forwarding and iptables masquerading has been taken care of):

Adding the a route on 10.0.0.1 like

route add -net 172.20.10.0 netmask 255.255.255.128 dev br0

makes it possible on 10.0.0.1 to reach the 172.20.10.0/25 network, but thats it. A traceroute from any other client shows that the requests get stuck at 10.0.0.1 and therefore they can not reach the other network until I configure the same route on all of them individually. But this contradicts the idea of 10.0.0.1 being the gateway.

The routing table of 10.0.0.1 after using the above noted command looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         <WANIP IS HERE> 0.0.0.0         UG        0 0          0 eth0
10.0.0.0        0.0.0.0         255.255.255.128 U         0 0          0 br0
<WANIP IS HERE> 0.0.0.0         255.255.255.252 U         0 0          0 eth0
172.20.10.0     10.0.0.100      255.255.255.128 UG        0 0          0 br0

What am I missing here?

Thank you very much for your time and answers to this probably very silly issue!

  • I believe that the DHCP server needs to be configure so that it informs automatically to the computers in 10.0.0.0/25 that he is a route for the other subnet 172.20.10.0/25. Not sure how to do it though. This is only required because 172.20.10.0/25 is considered non routable subnet and unless a route is specified for each then the clients won't try to make a request. – Torrien Jan 8 at 4:01
  • Maybe take a look at ral-arturo.org/2018/09/12/dhcp-static-route.html – Torrien Jan 8 at 4:07
  • @Torrien so based on your answer it could help to change the subnet from 172.20.10.0 to something like 192.168.0.0? – Happy Striker Jan 8 at 4:30
0

Normally the gateway (in this case your 10.0.0.1 system) will send ICMP redirect messages to direct clients to a different gateway when it has a route to the required network via another host on the same network (i.e. 10.0.0.100 in your case).

However for that you need to add an iptables rule to allow forwarding from the internal network to the internal network, which perhaps doesn't sound logical, but actually is, as it's effectively sending traffic from the internal network to the internal network.

Add the following rule:

iptables -A FORWARD -i br0 -o br0 -j ACCEPT

Now, when a client host on your 10.0.0.0/25 network wants to access 172.20.10.x, that host sends the packet to its default gateway i.e. 10.0.0.1. That default gateway knows that the route to 172.20.10.0/25 is via 10.0.0.100, so it sends back to the client host an ICMP redirect 172.20.10.x to host 10.0.0.100 packet. The client host adds a temporary route for the target host and will use 10.0.0.100 as the gateway for that host.

The client host has to be configured to accept such ICMP redirects, as these may present a security issue when rogue redirects are sent to divert traffic to a fake gateway, however it is the default in Linux, Windows also accepts them. In Linux it can be controlled via the net.ipv4.conf.default.accept_redirects sysctl setting.

  • Thank you very much so far for the detailed answer! Now the whole situation makes a lot more sense to me. So I have applied the above mentioned iptables rule to the 10.0.0.1 server and sending a ping does work now. But any other request, like a http request to port 80, still fails. What am I missing? – Happy Striker Jan 8 at 15:12
  • That's strange, if ping works then http should also work. Just to check: the hosts on the 172.20.10.x network know that from their side 10.0.0.x is reachable via that same second "gateway"? I.e. the same "trick" might need to be done on the other network. – wurtel Jan 9 at 8:21
0

To the previous answer of @Wurtel I would add that you would need to also type:

echo 1 > /proc/sys/net/ipv4/ip_forward

Moreover, you have to also masquerade your connections by:

IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Otherwise the outgoing traffic will not be properly treated.

  • Masquerading is not necessary in this scenario, the real IPs are routed. Good point about ip_forward though. – wurtel Jan 9 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.