Connect two subnets on busybox based router

Question

I have the following network topology, I've tried to ilustrate, so pardon me for bad painting skills.

I want to be able to communicate from 10.0.0.0/24 network to 192.168.1.0/28 because I want to set up a logging machine as a virtualbox ran on my LAN, plus few other purposes.

I can access my Firewall from 192.168.1.0/28 network , but I can not do the reverse.

I know that routes must exist in both way in Asus Router which is BusyBox based, but I always fail to add a route.

Here is the routing tables:

    Asus:
/home/root # ip r s
default via 192.168.0.2 dev eth2.2  metric 1 
127.0.0.0/8 dev lo  scope link 
192.168.0.0/24 dev eth2.2  proto kernel  scope link  src 192.168.0.3 
192.168.1.0/28 dev br0  proto kernel  scope link  src 192.168.1.1 



    Firewall:

admin@piwall:~$ ip r s
default via 10.0.0.1 dev eth0  metric 202 
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.2  metric 202 
169.254.0.0/16 dev eth1  proto kernel  scope link  src 169.254.51.49  metric 203 
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.2 
192.168.1.0/28 via 192.168.0.2 dev eth1 

Can someone instruct me how to add routes properly to accomplish my tasks and explain a bit, I would be thankful.

Thanks!

Answer 1

There is one route which is not correct, on the Firewall:

192.168.1.0/28 via 192.168.0.2 dev eth1

should be instead:

192.168.1.0/28 via 192.168.0.3 dev eth1

In other words, the via keyword precedes the IP address of the machine thru which the connection is to be made, your Asus router in this case. You have used instead the IP address of the very same machine from which the connection starts.

For this to work, there are three other conditions, the first one of which is irrelevant to you but I mention it for all those who are configuring a normal pc as a router:

1. Enable IPv4 forwarding by uncommenting the line

   #net.ipv4.ip_forward=1
   

   in the file /etc/sysctl.conf, and then force this rule with

   sudo sysctl -p
   

   . This is irrelevant to you because your Asus router is already working as a router, hence it surely has this option correctly configured.

2. Make sure your firewall rules on the Asus router allow connections to flow backwards. You see, routers also protect machines within their LAN by dropping direct communications attempt, unless port forwarding is enabled. But this is too restrictive for you, because you want unlimited access from the Firewall to your LAN. Hence you will need these two rules:

   iptables -a INPUT -s 192.168.0.2 -d 192.168.1.0/24 -j ACCEPT
   iptables -a FORWARD -s 192.168.0.2 -d 192.168.1.0/24 -j ACCEPT
   

   These two rules accept communications (the first one entrance onto the router, the second one transfering it to the internal interface) from only the Pi machine (for obvious security reasons), to any pc in your LAN, irrespective of the ports being used. This is wider than allowing simply some port forwarding.

3. Your router will be doing NAT, which means that all outgoing packets are rewritten as if they are coming from the Asus router's outer interface, the one with IP address 192.168.0.3. This means that all reply packet to the Pi firewall will appear to be coming from a different IP address than the one to which the initial connection was addressed, and they will thus be discarded by the Pi firewall for obvious security reasons (this situation mimics a man in the middle attack).

   In order to circumvent this problem, you may very well suspend NAT on the Asus only for packets destined to the Pi firewall, as follows:

   iptables -t nat -A POSTROUTING -d 192.168.1.2 -j ACCEPT
   

   For this to work, you need to make sure (by visually checking it with

   iptables -t nat -L -n -v
   

   ) that the above rule is listed before the following rule

   iptables -t nat -A POSTROUTING -j MASQUERADE
   

   The reason is that iptables rules are applied sequentially, until the first rule that applies is found, and then inspection of all following rules is not performed. In this case, making sure that the rules are in this order assures us that packets destined to the Pi firewall will not be rewritten.

Answer 2

Your routing tables are correct – it's more likely that the Asus router, having been made as a home WAN gateway, has a firewall enabled which blocks all incoming connections. See if you can disable it.

(If the NAT feature is active, you should disable that too. It's probably not the problem here, but it's completely unnecessary to do NAT twice in the same LAN.)