Allow IP packet forwarding from LAN to modem via router

Question

In short: I'd like to be able to telnet to my modem from my PC via my router.

There is a simple home router on 192.168.33.1. It is running OpenWrt. It has the following interfaces defined:

br-lan    Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan1      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan2      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan3      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan4      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lo        Link encap:Local Loopback
pppoe-wan Link encap:Point-to-Point Protocol
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0

I think only one or two have relevance here:

root@TIBERIUS: ~ > ifconfig wan
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2295 errors:0 dropped:1 overruns:0 frame:0
          TX packets:2740 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:270389 (264.0 KiB)  TX bytes:245297 (239.5 KiB)

root@TIBERIUS: ~ > ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6252 errors:0 dropped:0 overruns:83 frame:0
          TX packets:4725 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:863045 (842.8 KiB)  TX bytes:667374 (651.7 KiB)
          Interrupt:4

None has an IP address assigned to it. But pppoe-wan does. And that's the way Internet access works on this box, via PPPoE.

The DSL modem is connected to the router on the WAN port. The one labeled such on the casing. (I do not understand why there are both eth0 and wan.) It has a built-in IP address of 192.168.1.1. It can be audited via telnet.

The first step to do so is to set up an interface on the router box to reach the modem through.

root@TIBERIUS: ~ > ifconfig eth0 192.168.1.220
root@TIBERIUS: ~ > ping 192.168.1.1 -I eth0
PING 192.168.1.1 (192.168.1.1): 56 data bytes
^C

This adds a route, but doesn't work, not even adding the -I switch. Must be the wrong interface. (I don't know what eth0 corresponds to on this box. Maybe the LAN part, not the WAN part?) Anyway, I then reset the network settings (/etc/init.d/network restart) and repeat the procedure for wan, and that does work:

root@TIBERIUS: ~ > ifconfig wan 192.168.1.222
root@TIBERIUS: ~ > ping 192.168.1.1 -I wan
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=1.205 ms
64 bytes from 192.168.1.1: seq=1 ttl=64 time=0.496 ms

Audit via telnet also works.

Now I'd like to also work from my PC on the LAN. My PC is on 192.168.33.152. Trying to telnet the modem from the PC results in "connection refused". And I can't ping the modem either ("Antwort von 192.168.33.1: Zielport nicht erreichbar." = "destination port not reachable").

From what I understand about iptables from various docs and graphical schemas floating about the net, packets from the LAN to the modem will enter PREROUTING chain on the router (no destination NAT needed), then after routing (hopefully) the FORWARDING chain, and then (hopefully) the POSTROUTING chain (source NAT required).

However, I don't have a clue how to fit this in with the various chains predefined by OpenWrt. There's a couple of them in nat:

root@TIBERIUS: ~ > iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N nat_reflection_in
-N nat_reflection_out
-N postrouting_rule
-N prerouting_lan
-N prerouting_rule
-N prerouting_wan
-N zone_lan_nat
-N zone_lan_prerouting
-N zone_wan_nat
-N zone_wan_prerouting
-A PREROUTING -j prerouting_rule
-A PREROUTING -i br-lan -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -j zone_wan_prerouting
-A POSTROUTING -j postrouting_rule
-A POSTROUTING -o br-lan -j zone_lan_nat
-A POSTROUTING -o pppoe-wan -j zone_wan_nat
-A postrouting_rule -j nat_reflection_out
-A prerouting_rule -j nat_reflection_in
-A zone_lan_prerouting -j prerouting_lan
-A zone_wan_nat ! -d 192.168.1.0/24 -j MASQUERADE
-A zone_wan_prerouting -j prerouting_wan

And many more in filter:

root@TIBERIUS: ~ > iptables -S -t filter
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N forward
-N forwarding_lan
-N forwarding_rule
-N forwarding_wan
-N input
-N input_lan
-N input_rule
-N input_wan
-N nat_reflection_fwd
-N output
-N output_rule
-N reject
-N syn_flood
-N zone_lan
-N zone_lan_ACCEPT
-N zone_lan_DROP
-N zone_lan_REJECT
-N zone_lan_forward
-N zone_wan
-N zone_wan_ACCEPT
-N zone_wan_DROP
-N zone_wan_REJECT
-N zone_wan_forward
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A INPUT -j input_rule
-A INPUT -j input
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j forwarding_rule
-A FORWARD -j forward
-A FORWARD -j reject
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j output_rule
-A OUTPUT -j output
-A forward -i br-lan -j zone_lan_forward
-A forward -i pppoe-wan -j zone_wan_forward
-A forwarding_rule -j nat_reflection_fwd
-A input -i br-lan -j zone_lan
-A input -i pppoe-wan -j zone_wan
-A output -j zone_wan_ACCEPT
-A output -j zone_lan_ACCEPT
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan -j input_lan
-A zone_lan -j zone_lan_ACCEPT
-A zone_lan_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_ACCEPT -i br-lan -j ACCEPT
-A zone_lan_DROP -o br-lan -j DROP
-A zone_lan_DROP -i br-lan -j DROP
-A zone_lan_REJECT -o br-lan -j reject
-A zone_lan_REJECT -i br-lan -j reject
-A zone_lan_forward -j zone_wan_ACCEPT
-A zone_lan_forward -j forwarding_lan
-A zone_lan_forward -j zone_lan_REJECT
-A zone_wan -p udp -m udp --dport 68 -j ACCEPT
-A zone_wan -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A zone_wan -j input_wan
-A zone_wan -j zone_wan_REJECT
-A zone_wan_ACCEPT -o pppoe-wan -j ACCEPT
-A zone_wan_ACCEPT -i pppoe-wan -j ACCEPT
-A zone_wan_DROP -o pppoe-wan -j DROP
-A zone_wan_DROP -i pppoe-wan -j DROP
-A zone_wan_REJECT -o pppoe-wan -j reject
-A zone_wan_REJECT -i pppoe-wan -j reject
-A zone_wan_forward -j forwarding_wan
-A zone_wan_forward -j zone_wan_REJECT

How can I file my rules in this set of chains?

(Feeling encouraged to ask this here because another user was similarly bewildered by the set of default chains in OpenWrt.)

BillThor · Accepted Answer · 2012-11-30 02:23:12Z

1

Normally, I would expect you to have VLANs. These are commonly all allocated to eth0 with names like eth0.0 and eth0.1. Starting there would be a good start.

All your LAN acccess is likely on the br_lan (which may be eth0.0). If weren't using pppoe, the the WAN would be accessed over the other VLAN (likely eth0.1). The VLAN assignments may be different on different hardware.

On the systems where I have used pppoe, the router was not reachable directly. I don't believe it had an IP address that I could use. Can you telnet to the modem if you connect your PC to it directly?

answered Nov 30, 2012 at 2:23

BillThor

8,88722 silver badges27 bronze badges

I do not seem to have VLANs on that router. No dotted interfaces. There is /proc/net/vlan/config, but it's just two lines, VLAN Dev name | VLAN ID and Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD. Looks unused. Wonder how VLANs would relate to those »zones« that OpenWrt defines (as Shorewall does). - br-lan: Yes, that seems to be bridged Ethernet and WiFi. - Yes, I can telnet to my modem from any computer in the same subnet. The problem here is not with the modem but with the router inbetween.
– Lumi
Nov 30, 2012 at 16:01
I've read up on VLANs and come to the conclusion that (a) my router does support them (via the kmod-8021q kernel module which I would have to install (hardly any space left on that tiny box), the vconfig utility being already present as part of the BusyBox binary), and (b) I do not need VLANs in my home network. VLANs seem to be a very useful configuration option when you need them, but I'm not sure how much they're related to my problems with Netfilter configuration. At least, now that I know about VLANs, I know that I don't need them.
– Lumi
Nov 30, 2012 at 16:47
1

@Lumi As all your ports have the same MAC address, the WAN and LAN ports are would be on the same network. Normally, routes like this have two default VLANs configured. Try ifconfig | less to get a list of configured network devices.
– BillThor
Dec 1, 2012 at 2:45
Well, ifconfig is how I'm trying to find out what's going on. :) Looks like there's a convention of naming virtual Interfaces like eth0.1. But it's just a convention, and it is definitely not adhered to on my box. It is not clear to me how to find out whether a Network Interface is physical or virtual. Strange how this is so non-obvious ...
– Lumi
Dec 1, 2012 at 12:12

Add a comment |

Stack Exchange Network

Allow IP packet forwarding from LAN to modem via router

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
iptables
routing
openwrt
router
.

Linked

Hot Network Questions

Allow IP packet forwarding from LAN to modem via router

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged iptablesroutingopenwrtrouter.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
iptables
routing
openwrt
router
.