Feizhou wrote:
> If your box has a link on 55.20.0.0/255.255.0.0 and then more physical
> links to 56.1.x.0/24 individually (machines on two separate physical
> networks) or one more physical link to 56.1.1.0/23 (all machines on
> one physical network and you are going to assign ips from 56.1.1.x and
> 56.1.2.x) then all you need is setup the default route of the box to
> 55.20.0.2, enable ip forwarding and then point the default route of
> all clients to the box's corresponding ip on their subnets (eg: two
> physical links, 56.1.1.1 and 56.1.2.1) or on their subnet (only one
> physical link, 56.1.1.1)
>
> If you want to control what packets get through the box, use the
> iptables -t filter FORWARD chain.
>
That is what I thought, but it doesn't seem to be working.
Here is the routing table of the Linux Router box
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
192.168.1.0 * 255.255.255.0 U 0 0 0
green
192.168.8.0 * 255.255.255.0 U 0 0 0 red
169.254.0.0 * 255.255.0.0 U 0 0 0
green
default 192.168.8.2 0.0.0.0 UG 0 0 0 red
I've given the real IP's this time as it is only a virtual machine.
The names probably say enought but to clarify 192.168.8.0 is the Public
facing subnet (what would be in the ISP Cloud I guess), with 192.168.8.2
as the default gateway, this is pingable from the router. 192.168.1.0
is the private subnet with 192.168.8.254 as the routers internal IP.
Workstations can ping the internal IP of the router but not anything
outside, nor does a traceroute work.
IP Forwarding has been enabled by: "sysctl -w net.ipv4.ip_forward = 1"
The iptables rules are all clear as follows:-
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Here is the routing table from the client machine:-
Destination Gateway Genmask Flags Metric Ref Use
Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth0
default 192.168.1.254 0.0.0.0 UG 0 0 0 eth0
From what you have said this should work fine, but I'm clearly missing
something obvious that I just cannot see.
Thanks again for any help
Regards
Lee
