0

I have a system that looks like so:

+----------+     +--------+     +--------+
|          |     |        |     |        |
| Internet |<--->| Modem  |<--->| Router |
|          |     |        |     |        |
+----------+     +--------+     +--------+
                                    ^
                                    |
                                    v
                                +--------+
                                |        |
                     +--------->| Switch |<--------+-------------+........ (other Cn computers)
                     |          |        |         |             |
                     |          +--------+         |             |
                     |              ^              |             |
                     |              |              |             |
                     v              v              v             v
                 +--------+     +--------+     +--------+     +--------+
                 |        |     |        |     |        |     |        |
                 |   A    |     |   B    |     |   C1   |     |   C2   |
                 |        |     |        |     |        |     |        |
                 +--------+     +--------+     +--------+     +--------+

The Router has a 192.168.x.x IP address.

Computers A and B are on the same local network (192.168.x.y and 192.268.x.z).

Computers C1 to Cn are on a sub-LAN with a different IP addresses (10.x.y.z).

So I setup B in such a way that the it can talk to C1 to Cn, it also has a 10.x.y.z IP address.

I have a firewall on all the computers to make sure that unwanted traffic gets stopped. I have services which I do not want people from the outside to connect to.

A and B work great. I have full Internet access and NTP works, etc. However, C1 to Cn have a problem. They do not get any reply from the outside. If I try to ping a public IP address, I get no return at all. I can ping B without a problem, though.

I can't see anything blocked by the firewalls on B or C1 to Cn when I do a ping, check the DNS, try to connect to anything on the Internet. So I'm thinking that the Router is the culprit.

The Router is a Netgear and the firewall is up. What I don't understand is that since the packets are being forwarded by B, if B works (sees the Internet) I would think that the forwarded packets of C1 to Cn would work just like B packets. I'm a bit at a loss here.

Here are a few entries representing the forwarding rules in the iptables:

This is part of the nat setup:

Chain POSTROUTING (policy ACCEPT 141 packets, 9904 bytes)
    pkts    bytes target     prot opt in     out     source               destination
     857    54781 SNAT       all  --  *      eno1    10.0.5.21            0.0.0.0/0            to:10.5.10.2

Here I have the FORWARD in the standard filter:

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
  pkts    bytes target     prot opt in     out     source               destination
    29     1884 bad_tcp_packets  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     0        0 ACCEPT     tcp  --  eno1   eno1   !10.0.5.1             10.0.5.16/28         state RELATED,ESTABLISHED tcp flags:!0x17/0x02
     0        0 ACCEPT     udp  --  eno1   eno1   !10.0.5.1             10.0.5.16/28         state RELATED,ESTABLISHED udp
     8      480 ACCEPT     tcp  --  eno1   eno1    10.0.5.16/28         0.0.0.0/0            tcp
    21     1404 ACCEPT     udp  --  eno1   eno1    10.0.5.16/28         0.0.0.0/0            udp

The flags mean -syn which is redundant from the state test. We're never too cautious...

Finally, in the INPUT chain I also have the RELATED,ESTABLISHED so returning packets do not get blocked:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
  pkts    bytes target     prot opt in     out     source               destination
    39     5428 ACCEPT     tcp  --  eno1   *       0.0.0.0/0            10.0.5.1             state RELATED,ESTABLISHED tcp flags:!0x17/0x02
     0        0 ACCEPT     tcp  --  eno1   *       0.0.0.0/0            10.5.10.2            state RELATED,ESTABLISHED tcp flags:!0x17/0x02

I have a very similar setup on another computer and it works just fine so I'm really thinking that it is the Netgear router. Anyone would know what is necessary to make that work properly?

3
  • echo 1 > /proc/sys/net/ipv4/ip_forward Jul 30 '20 at 7:31
  • @IporSircer, yeah, that's the first thing I've done :-) Jul 30 '20 at 7:35
  • I would suggest (if the switch can do it) to configure router-on-a-stick it is simple for maintaining and configuration
    – Angel
    Jul 30 '20 at 11:44
0

Okay! I got it to work.

So... on my other computer, the main computer (like A) is actually given a static IP address on the Internet. That means it works just like a router. In other words, anything that hits that computer has access to the Internet.

However, on that other new setup, computer A is on the LAN only, not directly on the Internet. So the to:<ip> needed to use that computer A address, not yet another local address which ended up to be "lost" in there.

Chain POSTROUTING (policy ACCEPT 141 packets, 9904 bytes)
    pkts    bytes target     prot opt in     out   source     destination
     857    54781 SNAT       all  --  *      eno1  10.0.5.21  0.0.0.0/0    to:10.5.10.2
                                                                              ^
                                    this had to be A's address 192.168.x.y ---+

That was it. Once I switched that one IP address it started to work like a charm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.