2

Hello fellow stackers,

I'm not sure I planned my network configuration in a perfect manner.

I have a home network topography like this:

modem/router <-> debian router <-> LAN.

I need to access the Internet from my LAN, behind a debian router.

When I have these 3 rules on the debian router, I can access WAN:

default via 192.168.0.10 dev enp1s0f1
10.0.0.0/24 dev enp1s0f0 proto kernel scope link src 10.0.0.12 
192.168.0.0/24 dev enp1s0f1 proto kernel scope link src 192.168.0.12

192.168.0.10 is my modem/router. 192.168.0.0/24 is the small LAN with the modem/router and a branch of the debian router. 10.0.0.0/24 is my private LAN where my Pi is.

My problem is that I cannot ping the modem 192.168.0.10 from my workstation 10.0.0.4, goind through the debian router.

EDIT: new tryout :

I modified in this way /etc/network/interfaces for the debian router:

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

allow-hotplug enp1s0f0
iface enp1s0f0 inet static
    address 10.0.0.12
    netmask 255.255.255.0

allow-hotplug enp1s0f1
iface enp1s0f1 inet static
    address 192.168.0.12
    netmask 255.255.255.0
    gateway 192.168.0.10

RESULT: passed networking service validation. It generates these routes on the debian router:

default via 192.168.0.10 dev enp1s0f1 onlink 
10.0.0.0/24 dev enp1s0f0 proto kernel scope link src 10.0.0.12 
192.168.0.0/24 dev enp1s0f1 proto kernel scope link src 192.168.0.12 

I can ping form the debian router the WAN, DNS ok, ping ok. From my Pi on the 10... network, I cannot ping the modem/router .10 . I can ping the other side interface of the debian router (192.168.0.12).

On the debian router I have these ufw settings:

*nat

#:PREROUTING ACCEPT - [0:0]
:POSTROUTING ACCEPT - [0:0]

#Port fwd
#-A PREROUTING -i enp1s0f1 -p tcp --dport 22 -j DNAT --to-destination 10.0.0.3

# Forward traffic from source through iface
-A POSTROUTING -s 10.0.0.0/24 -o enp1s0f1 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't be processed
COMMIT

I don't know why I cannot ping the modem/router from the Rasbian (ping allowed on ufw - don't know if it is meaningful).

net.ipv4.ip_forward=1 is set on the debian router.

iptables -nvL:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 117K 7348K ACCEPT     all  --  enp1s0f0 *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -t nat -nvL:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

On the Rasbian I have theses routes (simplified):

default via 10.0.0.12 { the debian router's directly connected iface }
10.0.0.0/24 via 10.0.0.12

So, any clues why I can't ping the modem from the Raspbian Pi? :-)

  • You could add more than one default route if you give them different metrics; eg. ip route add default ... metric 1 .. metric 2. Don't know if this helps you with your actual problem, though. – mosvy Nov 25 '19 at 17:51
  • 1
    note if it wasn't clear: gateway = default route, the one used with ip route add default ... (where you're using one, not 3) – A.B Nov 25 '19 at 19:08
  • 1
    @mosvy you can't usefully have two default routes. If you have two with different metrics then the one with the lower metric is the default route and the other is a no-op. – roaima Nov 25 '19 at 22:44
  • 1
    @roaima what's the configuration descibed here? ;-) to the OP: it would help if you told what error you get from ping: "cannot ping" is too broad. Also, it's not at all clear (at least for me) that your router is actually configured to do forwarding (sysctl net.ipv4.ip_forward?) – mosvy Nov 26 '19 at 8:26
  • 1
    I was going to write an answer and then realised there's a pretty good walk through of setting up a Linux router on the redhat website. The steps listed also work on Debian: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/… – Philip Couling Nov 26 '19 at 11:09
1

Assuming the iptables output is from the Debian router, your firewall MASQUERADE rule hasn't been applied. (In fact, none of your rules has been applied.)

To fix the problem you can do one of two things

  1. Apply the firewall rules using the appropriate ufw command (I don't use ufw) so that your entire 10.0.0.0/24 network is hidden behind the single externally-facing IP address of your Debian router

OR

  1. Create a static route on the modem/router that declares it can reach your internal 10.0.0.0/24 network via 192.168.0.12. Otherwise its default route, pointing upstream, will be the only place it will know to send such packets.
| improve this answer | |
  • thank you. Your answer lighted a bulb, I found the problem, see my answer. I'm sorry to have wasted your time for such a stupid error. Ty very much :-) – sugarman Nov 29 '19 at 7:11
0

I found the problem. I must have forgotten to set

DEFAULT_FORWARD_POLICY="ACCEPT"

into /etc/default/ufw.

As @roaima pointed out, there were no ACCEPT rules prior to FORWARD ACCEPT. Now, everything works as expected :-)

| improve this answer | |
  • IF the iptables output you gave us was indeed from the Debian router, the policies were already set to ACCEPT. What you were missing is the MASQUERADE or the static route just as I desctibed in my answer. That UFW may have changed the default firewall policiy is then a corrollary that you have addressed in your answer here. – roaima Nov 29 '19 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.