Connecting blackbox host to PAN

Question

I got following scheme:

                               /-----\
                ------------- (  ISP  )
+---------+    /               \-----/
|         0 --/        +---------+
| gateway 1 ---------- |L2 switch| --- ~5-10 clients
|         2 --\        +---------+
+---------+    \    +--------+
                --- |Blackbox|
                    +--------+

0, 1 and 2 digits are stands for eth? index.

The gateway is 10.0.1.1/24, it offers DHCP and DNS services via dnsmasq. It uses iptables masquerading to provide external world access for the clients.

Clients are 10.0.1.x machines, they obtain IPs from gateway respectively, this is an environment of mixed OS.

The problem is the "Blackbox" host, it contains few requirements which I can not satisfy: - it must be attached to eth2 of gateway - it should be able to obtain IP via DHCP - it should be reachable from gateway - it should be reachable from client hosts without manual adding routes on each machine

Why "Blackbox"? I got 0 knowledge about how it works and have no access to it.

I'm currently trying to offer Blackbox an IP from same 10.0.1.0/24 subnet, but default route on gateway points to eth1 device, so I'm forced to add one static route, like:

ip r add 10.0.1.${blkbx} dev eth2

It makes Blackbox available from gateway, but clients can not see it. They are even not making it to gateway, traceroute shows fail on the very 1st hop.

Could you please propose simple and possibly clear scheme to complete the task? Could you please describe, should eth2 have IP from same subnet? Should I offer Blackbox IP from same subnet to evade setting up any new routes? Should I bridge eth1 and eth2?

I got root access on the gateway host, can add/delete routes, manage gateway IPs and DHCP leases. And, of course, I'm ready to answer your questions, if you have any.

Trying to defeat it for the few hours already, but no success so far. :(

Answer 1

I'm currently trying to offer Blackbox an IP from same 10.0.1.0/24 subnet

Please do not assign the same subnet to the eth2. Actually, your Linux server(Gateway) acts as a router. Assigning same subnet on different interfaces is not allowed on the physical router(Cisco). It's called overlap.

You should assign the different subnet on the eth2, such as 10.0.2.0/24. Also, you need to modify the configuration of DHCP and iptables, so that the black box can get the IP address and the traffic from the black box to internet can be NAT correctly.

Hope this helps.