currently I'm trying to connet two local networks as it seems both networks don't know each other.
Herre is the network setup:
My local home network: 192.168.0.0/24 A Rasperry Pi as an Access
Point using it's own network (for DHCP functionality, etc): 192.168.1.0/24
Raspberry Pi setup:
- eth0: not connected
- wlan0: 192.168.0.117
- wlan1: 192.168.1.1
- Ping RasPi 192.168.1.1 to RasPi Client 192.168.1.2 => successful
- Ping RasPi 192.168.0.117 to PC 192.168.0.120 => successful
- Ping RasPi 192.168.0.117 to Google (http://www.google.de) => successful
PC setup:
- RJ45 Connection: 192.168.0.120
- WiFi: not connected
- Ping PC 192.168.0.120 to RasPi 192.168.0.117 => successful
- Ping PC 192.168.0.120 to RasPi 192.168.1.1 => successful
- Ping PC 192.168.0.120 to Google (http://www.google.de) => successful
Any RasPi Client (for example my iPhone4S, which is supposed to use the RasPi WiFi network) setup: Connected to the RasPi WiFi (192.168.1.0/24):
- WiFi: 192.168.1.2
- Ping RasPi Client 192.168.1.2 to PC 192.168.0.120 => not successful (timeout)
- Ping RasPi Client 192.168.1.2 to RasPi 192.168.0.117 => successful
- Ping RasPi Client 192.168.1.2 to RasPi 192.168.1.1 => successful
- Ping RasPi Client 192.168.1.2 to nach Google (http://www.google.de) => not successful (timeout)
Connected to the Routers (Home) WiFi (same network like the PC 192.168.0.0/24)
- WiFi: 192.168.0.110
- Ping RasPi Client 192.168.0.110 to PC 192.168.0.120 => successful
- Ping RasPi Client 192.168.0.110 to RasPi 192.168.0.117 => successful
- Ping RasPi Client 192.168.0.110 to RasPi 192.168.1.1 => not successful (timeout)
- Ping RasPi Client 192.168.0.110 to Google (http://www.google.de) => successful
I'd like all devices in both networks to be able to connect to each other. The problem is that my home network router (192.168.0.1) unfortunately has no options in order to route the traffic between the two networks (can handle port forwarding only).
This is why I would like to use the RasPi in order to route the traffic between the two networks as the RasPi is a gateway as well.
This is the iptables setup of the RasPi:
Generated by iptables-save v1.4.14 on Fri Mar 14 23:34:55 2014
*filter
:INPUT ACCEPT [423:33976]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [533:57052]
COMMIT
Completed on Fri Mar 14 23:34:55 2014
Generated by iptables-save v1.4.14 on Fri Mar 14 23:34:55 2014
*nat :PREROUTING ACCEPT [3:96]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0]
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 22
-A PREROUTING -i wlan1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -i wlan1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 COMMIT
Completed on Fri Mar 14 23:34:55 2014
When my iPhone is connected to the network 192.168.1.0/24, I'd like to be able to ping my PC in the 192.168.0.0/24 network.
When my iPhone is conected to the network 192.168.0.0/24, I'd like to be able to ping the RasPi in the 192.168.1.0/24 network.
Do you have any idea how to accomplish that?
cheers, Dan
---EDIT 1--- So far the suggestions made didn't work. The only thing I've got working so far is the internet connection for the RasPi client, hence the ping to www.google.de.
I've edited the /etc/network/interfaces file:
auto lo
iface lo inet loopback
iface eth0 inet dhcpallow-hotplug wlan0
iface wlan0 inet dhcp
wpa-ssid "abcdef"
wpa-psk "123456789"allow-hotplug wlan1
iface wlan1 inet static
address 192.168.1.1
netmask 255.255.255.0
subnet 192.168.1.0up iptables-restore < /etc/iptables.ipv4.nat
post-up route del default gw 192.168.1.1 wlan1
post-up route add default gw 192.168.0.1 wlan0
The routing table looks now like this:
Ziel Router Genmask Flags Metric Ref Use Iface
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
192.168.0.0 * 255.255.255.0 U 0 0 0 wlan0
192.168.1.0 * 255.255.255.0 U 0 0 0 wlan1
As the internet is working with this solution, all I need is a connection between the two subnets. From the 192.168.1.0/24 network I'm still not able to reach the 192.168.0.0/24 network, just the internet via the gateway 192.168.1.1.
---EDIT 1---
---EDIT 2---
I've removed now the following lines from /etc/network/interfaces:
post-up route del default gw 192.168.1.1 wlan1
post-up route add default gw 192.168.0.1 wlan0
Therefore I've added the iptable rules mentioned from Lawrence. My iptable looks like this:
Generated by iptables-save v1.4.14 on Mon Apr 7 17:51:30 2014
*nat
:PREROUTING ACCEPT [39:1816]
:INPUT ACCEPT [1:384]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 22
-A PREROUTING -i wlan1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -i wlan1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT
--to-ports 9040
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
Completed on Mon Apr 7 17:51:30 2014
Generated by iptables-save v1.4.14 on Mon Apr 7 17:51:30 2014
*filter
:INPUT ACCEPT [28:3580]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [30:3192]
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan1 -j ACCEPT
-A FORWARD -i wlan1 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o wlan1 -j ACCEPT
COMMIT
Completed on Mon Apr 7 17:51:30 2014
Note: The three PREROUTING rules are necessary for the TOR proxy thats running on my Pi.
Result: The internet connection works, access from 192.168.1.0/24 to 192.168.0.0/24 still not possible. ---EDIT 2---
---EDIT 3---
I'm using another router now that supports static routes. Good thing is, I can ping all ips now no matter from which network to which. Unfortunately I still cant open any services. So I tried to do some port forwarding in order to fix that as well.
The scenario is:
192.168.1.2 (iPhone) -> 192.168.1.1 (RasPi Wlan1) -- 192.168.0.4 (RasPi Wlan0) -> 192.168.0.2:5901 (NAS)
The NAS has a service running on port 5901 and 80. Let's say I'd like to access the NAS on port 5901 from the iPhone, for that case I've tried the following iptables rule, again with no success:
iptables -A PREROUTING -t nat -i wlan1 -p tcp --dport 5901 -j DNAT --to 192.168.0.2:5901
iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 5901 -j ACCEPT
Any suggestions how to fix that?
---EDIT 3---