Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Windows desktop PC on my corporate LAN with 2 NICs and I selected both adapters and bridged them in the network options. I also have a Linux PC with 2 NICs and I configured the first one to get DHCP on the corporate LAN and the second one to have a static IP on an isolated network. I modified the route on the Linux PC so that corporate LAN traffic goes out the first NIC (eth0) and traffic to the isolated network goes out the second (eth1). So I can access both networks on the Linux PC.

                  Windows               
            +-----------------+    
10.x.x.x <- | NIC1 -+         |                          Linux
            |       | bridged |              +----------------------------+
            | NIC2 -+         |<-->switch<-->| NIC1 (DHCP 10.x.x.x)       |
            +-----------------+              |                            |
                                             | NIC2 (static 192.168.1.50) |<----> 192.168.1.x
                                             +----------------------------+

But I need to access a web server on the 192.168.1.x LAN from the Windows PC and I'm stuck. I have Windows set up to bridge the connections, so it's acting like a regular switch. I added a route to Windows to forward 192.168.1.x traffic to Linux NIC1. I can see using tethereal that Linux NIC1 is receiving the http packets from the Windows box on NIC1.

Now how do I route that traffic to NIC2 so that it will keep going to the 192.168.1.x network and be able to receive responses? I think that I need to turn the linux box into a router. So I tried adding some iptables rules:

 Chain INPUT (policy ACCEPT)
 target    prot opt source               destination
 ACCEPT    all  --  10.6.100.0/22        192.168.1.0/24
 ACCEPT    all  --  192.168.1.0/24       10.6.100.0/22

 Chain FORWARD (policy ACCEPT)
 target    prot opt source               destination
 ACCEPT    all  --  10.6.100.0/22        192.168.1.0/24   // (-o eth1)
 ACCEPT    all  --  192.168.1.0/24       10.6.100.0/22    // (-o eth0)

 Chain OUTPUT (policy ACCEPT)
 target    prot opt source               destination

I'm assuming I did something wrong because when I run iptables with --verbose I can see neither the INPUT nor FORWARD policy have processed any packets.

I also enabled promiscuous mode on both eth0 and eth1 with ipconfig.

I'd like to get this working with the existing hardware and topology. The Windows PC is where it is because I need it to sniff traffic entering and leaving the isolated network to debug equipment.

How can I get this working how I want?

share|improve this question
1  
i dont know the exact answer, but your looking at the wrong table in iptables. You should be adding iptable NAT rules to NAT the 10.x.x.x packets onto 192.168.x.x I cant remember the syntax of iptables to do this, but google for iptables -t NAT for examples –  Andrew Keith Dec 18 '09 at 1:28
    
no, he does not need NAT –  user23307 Mar 9 '10 at 22:17

1 Answer 1

i guess you did forget to activate the ip forwarding on the linux box. you can check this by issueing the command

cat /proc/sys/net/ipv4/ip_forward

if this gives you a '0' ip forwarding is disabled. to enable it issue this command:

echo 1 >/proc/sys/net/ipv4/ip_forward

note that this will only last till your next reboot. how to make this persistent is distribution dependent. most distros have a file called /etc/sysctl.conf. if this file exists open it using vi and check for a line

net.ipv4.ip_forward = 0

change the 0 to 1 and most probably it will enable ip forwarding next time you boot the machine. be sure to check after the reboot.

a note on your iptables: the chains do have the following meaning:

  • INPUT receives packets destined TO the linux box itself (so it won't see packets the linux box forwards
  • FORWARD receives packets htat the linux box forwards to other systems - so it won't see packets destined to the linux box itself
  • OUTPUT is only passed by packets which originate from the linux box itself (eg. generated from a locally running process like a ping command or such)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.