On 12/08/15 22:42, sillysausage wrote:
> I'm a bit stuck as to what the default route should be for the LAN
> table.
>
> In the past I've used something like:
>
> /sbin/ip route add table <table> default via ${IPLOCAL}
>
> However this table shouldn't be routed to ppp0 or tun0's IP.
>
I solved this problem it was as simple as creating an unreachable range
and then setting that to the default route:
# Add an unreachable subnet
ip route add unreachable 192.168.4.0/24
# Make the unreachable subnet the default gateway for members of LAN
/sbin/ip route add table LAN default via 192.168.4.0
> Likewise the from rule I've used in the past has usually been
> something like:
>
> /sbin/ip rule add from ${IPLOCAL} table <table>
>
This wasn't needed either, all I had to do was add an entry in each
table to see the 192.168.3.0/24 range eg:
# Add route to ISP from LAN
/sbin/ip route add 192.168.3.0/24 dev eth0 table ISP
# Add route to VPN from LAN
/sbin/ip route add 192.168.3.0/24 dev eth0 table VPN
> gateway:~# ip route add 192.168.1.0/24 dev eth0 table LAN
> gateway:~# ip route add 192.168.2.0/24 dev eth0 table LAN
> gateway:~# ip route add 192.168.3.0/24 dev eth0 table LAN
And of course this.
I removed all the fwmark 0x3 rules because that was me over thinking the
problem.
It does turn out I will need to buy myself a managed switch at some
point and use VLANs instead of virtual interfaces if I want to assign IP
addresses in this range. Virtual interfaces such as eth0:3 (192.168.3.1)
currently have the same broadcast as eth0 (192.168.1.1) which would mean
this will never work:
eg the printer will be assigned something in the 192.168.1.0/24 range.
gateway:~# cat /etc/dhcp/dhcpd.conf
authoritative;
ddns-update-style interim;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.10 192.168.1.240;
default-lease-time 259200;
max-lease-time 518400;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.1.255;
option routers 192.168.1.1;
option ntp-servers 192.168.1.1;
option domain-name-servers 192.168.1.1;
}
subnet 192.168.3.0 netmask 255.255.255.0 {
range 192.168.3.2 192.168.3.240;
default-lease-time 259200;
max-lease-time 518400;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.3.255;
option routers 192.168.3.1;
deny unknown-clients;
host printer {
hardware ethernet XX:XX:XX:XX:XX:XX;
fixed-address 192.168.3.25;
option subnet-mask 255.255.255.0;
option routers 192.168.3.1;
}
}
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
