1

So I am trying to set up a dual homed BRO IDS box to act as a gateway(?) server between my home network and the existing el cheapo router that came with the broadband. what I have is this... (pipes represent wire, sorry for poor formatting)

Internet  
   |  
ADSL Router running DHCP  (gateway is 192.168.1.254)  
   |  
eth0 (192.168.1.1)  
ubuntu 1404 server running bro IDS, running bind9,   
it serves DHCP on 192.168.2.0 network only on eth1  
eth1 (192.168.2.1)  
   |  
Internal LAN running two Apple Airports in bridge mode  

I have set things up correctly I feel, but the Ubuntu Server doesn't route. I can SSH on it and ping both interfaces from it, plus ping the Internet. However hosts on either of the LANs cannot route to the other side of the Ubuntu server.

Here is the output of routes -n

Kernel IP routing tableico /etc/network/interfaces
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         
192.168.1.254   0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

and here is the content of /etc/interfaces

auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
  address 192.168.1.1
  netmask 255.255.255.0
  gateway 192.168.1.254
  broadcast 192.168.1.255
 auto eth1   
 iface eth1 inet static  
  address 192.168.2.1  
  network 192.168.2.0  
  netmask 255.255.255.0  
  broadcast 192.168.2.255  
  gateway 192.168.1.254

I enabled ipv4 ipforwarding using sysctl. The Ubuntu DHCP server is configured to only serve 192.168.2.0 Ip addresses, and it works well. There is another DHCP router serving eth0 (192.168.1.0) which I've kept active to be able to use the wifi on the broadband router to browse the web while working the problem.

But in any event I have still failed to be able to ping the other side of the Ubuntu box after logging in to both sides with static and dynamically assigned IPs. can post the contents of dhcpd.conf too...?

Am I missing something simple? Are there any troubleshooting steps I can take on the Ubuntu box to verify narrow down the problem. Currently I just get 'no route found / exists' messages... Here's the /etc/dhcpd.conf particulars too...

ddns-update-style none;  
default-lease-time 600;  
max-lease-time 7200;  
authoritative;  
subnet 192.168.2.0 netmask 255.255.255.0 {  
range 192.168.2.2 192.168.2.240;  
option routers 192.168.1.254;  
option broadcast-address 192.168.2.255;  
option domain-name-servers 192.168.2.1, 8.8.8.8;  
}  

This is the output from ping across router

Request timeout for icmp_seq 0  
Request timeout for icmp_seq 1  
Request timeout for icmp_seq 2  

Also, while configuring it, I set it up as a bridge initially, but that configuration was removed from interfaces ages ago (it didn't work at all)

As requested, here is the output from iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

2
  • iptables for NAT and masquerading? Jun 3, 2015 at 0:47
  • I switched on masquerading as a last resort yesterday, rebooted and no change. IPtables is in it's default state - I have updated the question to show output from iptables -L Jun 3, 2015 at 7:30

2 Answers 2

1

There are a few things that do not appear clear, at least to me at first sight.

  1. The following line in /etc/dhcpd.conf is surely wrong:

    option routers 192.168.1.254;

it should be

  option routers 192.168.2.1

Currently, you are basically telling your DHCP clients that their default gateway is on a different subnet than theirs: how do you expect them to be able to reach said gateway? The correct address for the gateway you pass to the clients is the LAN interface of the router.

  1. When you say you cannot ping from DHCP clients, did you try with a name (e.g. www.google.com) or with an IP (e.g. 8.8.8.8)? It makes a difference because you said nothing about DNS resolution, so it might happen that

    ping -c1 8.8.8.8

gets a reply, while

   ping -c1 www.google.com

does not. If this is the case, you are only missing the following two lines in /etc/resolv.conf:

  nameserver 8.8.8.8
  nameserver 8.8.4.4

If this is not the case, pls read on.

  1. What you say about iptables is not fully consistent, because you claim you have added the rule for NATting in iptables, but then you display the existing iptables rule for the filter table, not the nat table. So, please issue the following command

    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

and then, without rebooting, try issuing the same ping commands as above.

If all of this fails, then please open two terminals on the Ubuntu machine, and issue the following two commans: in terminal 1,

  tcpdump -i eth0 -n icmp

and in terminal 2

  tcpdump -i eth1 -n icmp

then go to one of the DHCP clients, and try one of the ping commands above. If everything works, you should see both ping and its reply fly through both terminals. If you do not, please paste the output for another round of help.

2
  • Awesome, Marius, you have fixed it, and helped me understand the problem and troubleshooting. Kudos, man. I changed the incorrect DG this morning (took a while to propagate I guess, didnt work immediately) and then I changed Iptables with the command suggested, and the whole setup has snapped into place after three days struggle. The Airport routers are now serving the 'safe' network. BTW apologies for not mentioning DNS in more detail in the question (resolv.conf has been correct for days) Jun 3, 2015 at 16:38
  • BTW I'm a newb here, is there anything I can do to make yours the 'winning' answer - I dont have enough credit to upvote yet! Jun 3, 2015 at 16:43
0

Your Ubuntu router is routing just fine. That's not the problem. The problem is that your configuration can't work because the ADSL router has no idea how to reach machines on the 192.168.2.x network. Also, no device is configured to do NAT for the 192.168.2.x network. So your configuration just doesn't make sense.

So, for exaample, say 192.168.2.9 pings 8.8.8.8. The Ubuntu server routes it along its default route just fine. But then the ADSL router receives a packet from 192.168.2.9 to 8.8.8.8 on its LAN interface and has no idea what to do with it.

Update: To see just one problem, consider the routing table on the ADSL router. The only local route it has is for 192.168.1.0/24 to the LAN. Every other route goes to the link to your ISP. So when it handles a packet to 192.168.2.1, its routing table says to send that packet out to the Internet. That clearly won't work.

6
  • Thanks v much for the analysis, however NAT is being performed by the ADSL router. Also, I cannot ping the 192.168.1 network from 192.168.2 (and vice versa) and the ADSL router would not be involved in that? Would youj mind expanding your answer, I'm not sure I'm quite understanding it? Thanks again for replying! Jun 3, 2015 at 8:57
  • NAT is being performed by the ADSL router for the 192.168.1.0 network. It doesn't even know how to reach hosts in the 192.168.2.0 network, nor would it have any reason to NAT for them (any more than it would NAT for any other address not on its LAN). Jun 3, 2015 at 9:43
  • Of course you can't ping -- the ADSL router has no idea how to reach hosts on the 192.168.2.0/24 network. Why would it send those packets to the Ubuntu server? You're expecting routing to do magic. (Imagine the router is trying to route a packet to 192.168.2.1 -- what do you think it would do with it and why? Hint: The only route it matches is its default route out to the Internet!) Jun 3, 2015 at 9:45
  • "It doesn't even know how to reach hosts in the 192.168.2.0 network" Thats a fair point - I had overlooked that. Jun 3, 2015 at 17:01
  • And the next part is that even if it did know how to reach them, it wouldn't know that it was supposed to NAT for them. So the problem is that the Ubuntu server is routing just fine, but that's not what it needs to do. Jun 3, 2015 at 18:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .