My Linksys router (IP 192.168.1.1 inside a /24 subnet) is connected to my ADSL modem (IP 10.0.0.138 inside a /24 subnet) to establish an internet connection via PPPoE. To be able to access the modem's webinterface from one of the PCs that are connected to the router, the following commands need to be executed on the router:
ip addr add 10.0.0.1/24 dev vlan1 brd + iptables -I POSTROUTING -t nat -o vlan1 -d 10.0.0.138 -j MASQUERADE
As far as I understood this is necessary because the router would otherwise assume the IP 10.0.0.138 to be an external address since it is not part of its own 192.168.1.0/24 subnet.
But what are these two lines doing exactly? The first one seems to assign a second IP address to the vlan1 interface (which is basically the router's WAN port). The second one apparently modifies the source address of outgoing IP packets. But isn't that exactly what any home router does by default? By using
iptables -t nat -L I found that there is already a rule:
target prot opt source destination MASQUERADE all -- anywhere anywhere
Now the second commands adds
MASQUERADE all -- anywhere 10.0.0.138
to this table, but isn't this only a more specific version of the above rule and therefore redundant?
It would be great if someone could explain me the details of what's going on here exactly!
220.127.116.11 dev ppp0 proto kernel scope link src [my public IP] 10.0.0.0/24 dev vlan1 proto kernel scope link src 10.0.0.1 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1 127.0.0.0/8 dev lo scope link default via 18.104.22.168 dev ppp0
1: lo: mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo 2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff 3: eth1: mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:13:10:2f:fe:4a brd ff:ff:ff:ff:ff:ff 4: vlan0: mtu 1500 qdisc noqueue link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff 5: vlan1: mtu 1500 qdisc noqueue link/ether 00:13:10:2f:fe:49 brd ff:ff:ff:ff:ff:ff inet 10.0.0.1/24 brd 10.0.0.255 scope global vlan1 6: br0: mtu 1500 qdisc noqueue link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff inet 192.168.1.1/24 brd 192.168.1.255 scope global br0 ... 23: ppp0: mtu 1492 qdisc pfifo_fast qlen 3 link/ppp inet [my public IP] peer 22.214.171.124/32 brd [my public IP] scope global ppp0