routing within same nic card

routing within same nic card

[Wennie V. Lagmay]

Hello,

I have 1 NIC card with 2 ip address:
IP1 = 192.168.3.1/255.255.255.192
Network 1 = 192.168.3.0/255.255.255.192

IP2 = 192.168.4.1/255.255.255.248
Network 2 = 192.168.4.0/255.255.255.248

My question, how can workstations from network 1 reaches the workstations in 
network 2 and vice versa  using IPtables?

Thanks,

Wennie 

Re: routing within same nic card

[Taylor, Grant]

> I have 1 NIC card with 2 ip address:
> IP1 = 192.168.3.1/255.255.255.192
> Network 1 = 192.168.3.0/255.255.255.192
> 
> IP2 = 192.168.4.1/255.255.255.248
> Network 2 = 192.168.4.0/255.255.255.248
> 
> My question, how can workstations from network 1 reaches the 
> workstations in network 2 and vice versa  using IPtables?

This really is not an IPTables issue as this is more a routing issue than it is a packet filtering issue.  All you need to do to enable the ""routing would be to enable IP forwarding via one of these two methods:

sysctl -w net.ipv4.ip_forward=1

or

echo "1" > /proc/sys/net/ipv4/ip_forward

The only thing that IPTables might be interfering with this on would be if you have your default FORWARD policy to DROP.  In that case you would need to do something like the following:

iptables -t filter -A FORWARD -i eth0 -o eth0 -j ACCEPT

Or if you want to be more specific and specify what subnets can forward you would need the following rules:

iptables -t filter -A FORWARD -i eth0 -o eth0 -s 192.168.3.0/24 -d 192.168.4.0/24 -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth0 -s 192.168.4.0/24 -d 192.168.3.0/24 -j ACCEPT



Grant. . . .

Re: routing within same nic card

[Wennie V. Lagmay]

Hi,

The information you've given is very helpfull, however for your further 
analysis,I would like to give my exact config so that you can double check 
it

Presently I have 2 NIC cards;
eth1 = 212.119.xxx.98/30  directly connected to internet
eth0 = 212.119.xxx.105/29 connected to LAN, with this setup everything is 
working fine

now I need to add another network, since I cannot Add another NIC card, my 
solution is like this
eth1 = 212.119.xxx.98/30 directly connected to internet
eth0 = 212.119.xxx.105/29 connected to LAN1
eth0:1 = 192.168.3.0/26 connected to LAN2

I already done the 3 lines below
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD  -s 192.168.3.0/26 -d 212.119.xxx.104/29 -j ACCEPT
iptables -A FORWARD  -s 212.119.xxx.104/29 -d 192.168.3.0/26 -j ACCEPT

Thanks,
Wennie

----- Original Message ----- 
From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, May 31, 2005 8:49 AM
Subject: Re: routing within same nic card


>> I have 1 NIC card with 2 ip address:
>> IP1 = 192.168.3.1/255.255.255.192
>> Network 1 = 192.168.3.0/255.255.255.192
>>
>> IP2 = 192.168.4.1/255.255.255.248
>> Network 2 = 192.168.4.0/255.255.255.248
>>
>> My question, how can workstations from network 1 reaches the workstations 
>> in network 2 and vice versa  using IPtables?
>
> This really is not an IPTables issue as this is more a routing issue than 
> it is a packet filtering issue.  All you need to do to enable the 
> ""routing would be to enable IP forwarding via one of these two methods:
>
> sysctl -w net.ipv4.ip_forward=1
>
> or
>
> echo "1" > /proc/sys/net/ipv4/ip_forward
>
> The only thing that IPTables might be interfering with this on would be if 
> you have your default FORWARD policy to DROP.  In that case you would need 
> to do something like the following:
>
> iptables -t filter -A FORWARD -i eth0 -o eth0 -j ACCEPT
>
> Or if you want to be more specific and specify what subnets can forward 
> you would need the following rules:
>
> iptables -t filter -A FORWARD -i eth0 -o eth0 -s 192.168.3.0/24 -d 
> 192.168.4.0/24 -j ACCEPT
> iptables -t filter -A FORWARD -i eth0 -o eth0 -s 192.168.4.0/24 -d 
> 192.168.3.0/24 -j ACCEPT
>
>
>
> Grant. . . .
> 

Re: routing within same nic card

[Taylor, Grant]

> Presently I have 2 NIC cards;
> eth1 = 212.119.xxx.98/30  directly connected to internet
> eth0 = 212.119.xxx.105/29 connected to LAN, with this setup everything 
> is working fine
> 
> now I need to add another network, since I cannot Add another NIC card, 
> my solution is like this
> eth1 = 212.119.xxx.98/30 directly connected to internet
> eth0 = 212.119.xxx.105/29 connected to LAN1
> eth0:1 = 192.168.3.0/26 connected to LAN2

This seems reasonable enough.

> I already done the 3 lines below
> sysctl -w net.ipv4.ip_forward=1
> iptables -A FORWARD  -s 192.168.3.0/26 -d 212.119.xxx.104/29 -j ACCEPT
> iptables -A FORWARD  -s 212.119.xxx.104/29 -d 192.168.3.0/26 -j ACCEPT

This should also work as it allows traffic between the 192.168.3.0/26 212.119.xxx.104/29 networks.  I would need to see the contents of your nat table POSTROUTING chain to make sure that you would not be NATing traffic that you would not want.  Other than that I don't think you would have any problems.  Seeing as how you are not filtering based on interface I don't think you will have any issues with it.



Grant. . . .

Re: routing within same nic card

[Wennie V. Lagmay]

Grant,

Below is my existing config:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i ! eth1 -j ACCEPT
-A INPUT -p icmp -m state --state NEW -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 953 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-net-prohibited
-A INPUT -j DROP
-A FORWARD -s 192.168.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -d 192.168.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 192.168.11.0/255.255.255.0 -j ACCEPT
-A FORWARD -d 192.168.11.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 192.169.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -d 192.169.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 212.119.xxx.104/255.255.255.248 -j ACCEPT
-A FORWARD -d 212.119.xxx.104/255.255.255.248 -j ACCEPT
-A FORWARD -s 212.119.xxx.112/255.255.255.248 -j ACCEPT
-A FORWARD -d 212.119.xxx.112/255.255.255.248 -j ACCEPT
-A FORWARD -s 192.168.3.0/255.255.255.192 -d 
212.119.xxx.104/255.255.255.248 -j ACCEPT <<<<new entry
-A FORWARD -d 192.168.3.0/255.255.255.192 -s 
212.119.xxx.104/255.255.255.248 -j ACCEPT <<<<new entry

-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -p icmp -m limit --limit 1/s -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
-A OUTPUT -p udp -j REJECT --reject-with icmp-net-prohibited
-A OUTPUT -j DROP
#
COMMIT
# Completed on Thu Dec 23 08:44:33 2004
# Generated by iptables-save v1.2.8 on Thu Dec 23 08:44:33 2004
*nat
:PREROUTING ACCEPT [77:4447]
:POSTROUTING ACCEPT [85:7701]
:OUTPUT ACCEPT [85:7701]
#
-A PREROUTING -s 192.168.10.0/255.255.255.0   -p tcp -m tcp --dport 80 -j 
REDIRECT --to-ports 8080
-A PREROUTING -s 192.168.11.0/255.255.255.0   -p tcp -m tcp --dport 80 -j 
REDIRECT --to-ports 8080
-A PREROUTING -s 192.169.10.0/255.255.255.0   -p tcp -m tcp --dport 80 -j 
REDIRECT --to-ports 8080
-A POSTROUTING -s 192.168.10.0/255.255.255.0 -j SAME --nodst --to 
212.119.xxx.113-212.119.xxx.114
-A POSTROUTING -s 192.168.11.0/255.255.255.0 -j SAME --nodst --to 
212.119.xxx.115-212.119.xxx.116
-A POSTROUTING -s 192.169.10.0/255.255.255.0 -j SAME --nodst --to 
212.119.xxx.117-212.119.xxx.118
COMMIT



thanks,

wennie


----- Original Message ----- 
From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, May 31, 2005 9:31 AM
Subject: Re: routing within same nic card


>> Presently I have 2 NIC cards;
>> eth1 = 212.119.xxx.98/30  directly connected to internet
>> eth0 = 212.119.xxx.105/29 connected to LAN, with this setup everything is 
>> working fine
>>
>> now I need to add another network, since I cannot Add another NIC card, 
>> my solution is like this
>> eth1 = 212.119.xxx.98/30 directly connected to internet
>> eth0 = 212.119.xxx.105/29 connected to LAN1
>> eth0:1 = 192.168.3.0/26 connected to LAN2
>
> This seems reasonable enough.
>
>> I already done the 3 lines below
>> sysctl -w net.ipv4.ip_forward=1
>> iptables -A FORWARD  -s 192.168.3.0/26 -d 212.119.xxx.104/29 -j ACCEPT
>> iptables -A FORWARD  -s 212.119.xxx.104/29 -d 192.168.3.0/26 -j ACCEPT
>
> This should also work as it allows traffic between the 192.168.3.0/26 
> 212.119.xxx.104/29 networks.  I would need to see the contents of your nat 
> table POSTROUTING chain to make sure that you would not be NATing traffic 
> that you would not want.  Other than that I don't think you would have any 
> problems.  Seeing as how you are not filtering based on interface I don't 
> think you will have any issues with it.
>
>
>
> Grant. . . .
> 

Re: routing within same nic card

[Taylor, Grant]

Beyond a little bit of house keeping of duplicate rules and more open allows (destination or source only matches) I think what you have would work.  I do not see any thing that would keep your traffic from flowing like you want though you might find some traffic flow that you do not want.



Grant. . . .