Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My Linksys router (IP 192.168.1.1 inside a /24 subnet) is connected to my ADSL modem (IP 10.0.0.138 inside a /24 subnet) to establish an internet connection via PPPoE. To be able to access the modem's webinterface from one of the PCs that are connected to the router, the following commands need to be executed on the router:

ip addr add 10.0.0.1/24 dev vlan1 brd +
iptables -I POSTROUTING -t nat -o vlan1 -d 10.0.0.138 -j MASQUERADE

As far as I understood this is necessary because the router would otherwise assume the IP 10.0.0.138 to be an external address since it is not part of its own 192.168.1.0/24 subnet.

But what are these two lines doing exactly? The first one seems to assign a second IP address to the vlan1 interface (which is basically the router's WAN port). The second one apparently modifies the source address of outgoing IP packets. But isn't that exactly what any home router does by default? By using iptables -t nat -L I found that there is already a rule:

target      prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Now the second commands adds

MASQUERADE  all  --  anywhere             10.0.0.138

to this table, but isn't this only a more specific version of the above rule and therefore redundant?

It would be great if someone could explain me the details of what's going on here exactly!


Output of ip route:

87.186.225.71   dev ppp0   proto kernel  scope link  src [my public IP]
10.0.0.0/24     dev vlan1  proto kernel  scope link  src 10.0.0.1
192.168.1.0/24  dev br0    proto kernel  scope link  src 192.168.1.1
127.0.0.0/8     dev lo                   scope link
default via 87.186.225.71 dev ppp0

Output of ip addr:

1: lo:  mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0:  mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
3: eth1:  mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:13:10:2f:fe:4a brd ff:ff:ff:ff:ff:ff
4: vlan0:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
5: vlan1:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:49 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/24 brd 10.0.0.255 scope global vlan1
6: br0:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br0
...
23: ppp0:  mtu 1492 qdisc pfifo_fast qlen 3
    link/ppp
    inet [my public IP] peer 87.186.225.71/32 brd [my public IP] scope global ppp0
share|improve this question
    
MOREINFO about your setup is needed. please show the output of ip addr, routel and iptables-save. –  BatchyX Apr 20 '13 at 16:41
    
Your modem is problably configured with only the 10/24 subnet routed through its LAN port, so if you try to access your router with a source address in 192.168.1.0/24, it may try to route the response to its WAN port or discard the packet. Except to access the internet, your router probably already have an address in the 10/24 range, so that's a bit strange. The MASQUERADE rule also seems unnecessary at first glance, but iptables -L is known to hide some options that can make a huge difference. –  BatchyX Apr 20 '13 at 16:49
    
I'm running a modified Tomato firmware which does neither include routel nor iptables-save, sorry. I don't think that my router already has an IP in the modem's 10.0.0.0/24 range to access the internet, though, because PPPoE is located below the IP layer and therefore does not use any IPs. I found this link which tries to explain. What's still unclear is which IP is copied into the outgoing packets by the MASQERADE rule since the vlan1 has multiple IPs now (192.168.1.1 and 10.0.0.1). –  ph4nt0m Apr 21 '13 at 8:26
    
apparently, MASQUERADE chooses the address whose subnet contains the next hop's address, or something like that (Not sure why it doesn't just pick up the preferred source address). So that mean 10.1 for 10/24. If routel is not available, show the output of ip rule and ip route. Also show the output of iptables -t nat -S and iptables -S to replace iptables-save –  BatchyX Apr 21 '13 at 12:39
    
Unfortunately, ip rule doesn't work and the -S argument of iptables is not known. The firmware contains iptables v1.3.8 which is quite old I assume. Maybe at least ip route and ip addr are of any help, so I added the outputs to the main post. –  ph4nt0m Apr 21 '13 at 13:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.