1

I'm trying to build a prototype of a real network in VirtualBox. I have 3 guest systems:

  1. Debian-based router with 3 NICs:
    • enp0s3 Looks outsude.(bridged)
    • enp0s8 LAN1.(gateway to internal network 1)
    • enp0s9 LAN2.(gateway to internal network 2)
  2. WinXP workstation in LAN1.
  3. WinXP workstation in LAN2.
in /etc/sysctl.conf:

net.ipv4.ip_forward=1

iptables-save output:

# Generated by iptables-save v1.6.0 on Thu Mar 21 01:18:29 2019
*filter
:INPUT DROP [31:8959]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp0s8 -j ACCEPT
-A INPUT -i enp0s9 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 1 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 2 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i enp0s3 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i enp0s8 -o enp0s3 -j ACCEPT
-A FORWARD -i enp0s9 -o enp0s3 -j ACCEPT
-A FORWARD -i enp0s3 -o enp0s8 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i enp0s3 -o enp0s9 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 10.10.10.0/24 -d 10.10.11.0/24 -i enp0s8 -o enp0s9 -j ACCEPT
-A FORWARD -s 10.10.11.0/24 -d 10.10.10.0/24 -i enp0s9 -o enp0s8 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o enp0s8 -j ACCEPT
-A OUTPUT -o enp0s9 -j ACCEPT
-A OUTPUT -o enp0s3 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
COMMIT
# Completed on Thu Mar 21 01:18:29 2019
# Generated by iptables-save v1.6.0 on Thu Mar 21 01:18:29 2019
*nat
:PREROUTING ACCEPT [77:16001]
:INPUT ACCEPT [2:628]
:OUTPUT ACCEPT [2:143]
:POSTROUTING ACCEPT [2:143]
-A POSTROUTING -s 10.10.10.0/24 -o enp0s3 -j MASQUERADE
-A POSTROUTING -s 10.10.11.0/24 -o enp0s3 -j MASQUERADE
COMMIT
# Completed on Thu Mar 21 01:18:29 2019
# Generated by iptables-save v1.6.0 on Thu Mar 21 01:18:29 2019
*mangle
:PREROUTING ACCEPT [224:28224]
:INPUT ACCEPT [180:21810]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [144:17877]
:POSTROUTING ACCEPT [144:17877]
COMMIT
# Completed on Thu Mar 21 01:18:29 2019

DNSmasq acts as DHCP server
And the question is: how can i make workstation in LAN1 see one in LAN2? The internet is available to both, workstation1(10.100) can ping 11.1 gateway but can't reach 11.100 machine and vice versa. iptables is not likely to be the problem because it does not have dropped packages in statistics. And what seems interesting tcpdump shows 2 packages for every ping request with 0.0000x time difference.
P.S. It would be nice to make this all without adding static routes on clients if it is possible.

  • Is the Debian-based router the VirtualBox host or a guest machine? Please, could you also edit your question and add your complete iptables configuration (output of iptables-save)? Some time ago, I created a prototype of a network without any strong efforts. It should work well. – Anderson M. Gomes Mar 20 at 17:15
  • an easy (first) method to see if it's caused by iptables, is to display repetedly the counters eg with iptables-save -c and see where they are increasing in response to your attempts. So same as AndersonM.Gomes but also add the option -c – A.B Mar 20 at 20:01
0

I don't see any problems in your iptables configuration. That leads me to believe that firewalls running on workstations are preventing communication flows.

Please, do the following check:

  • On workstation 10.10.10.100, run ping -t 10.10.11.100
  • On your router, make sure the ICMP packets coming from 10.10.10.100 reach the output interface by running tcpdump -i enp0s9 icmp and host 10.10.11.100

As the workstation 10.10.11.100 has internet access, I also suggest you to install Wireshark version 1.10 on it (the last branch that supports Windows XP) and check whether packets are actually reaching the virtual adapter.

0

i am sorry for taking your time, but the reason was simple and dumb: WinXP firewall out-of-the-box cuts off icmp packets. Should have checked this earlier. Thank you all people for your attention, will be more careful next time.

  • No need to be sorry. Right now, you learned something that would happen on a real network. However, I would be pleased if you could mark my answer as accepted. – Anderson M. Gomes Mar 21 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.