I have a device (IP 10.110.1.3) with the following rule set up:
$ ip route default via 10.110.1.4 dev wlan0 onlink
I have ipv4 forwarding enabled on both machines. Both machines can talk to each other.
Here is my iptables. I want to route from interface wlp0s20u1 to wlp3s0:
$ iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT $ iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A POSTROUTING -o wlp3s0 -j MASQUERADE
Routes on the "routing" device 10.110.1.4:
$ ip route default via 192.168.1.1 dev wlp3s0 proto static 10.110.1.0/24 dev wlp0s20u1 proto kernel scope link src 10.110.1.4 192.168.1.0/24 dev wlp3s0 proto kernel scope link src 192.168.1.110 metric 600
Using the "if interface" route get, it's clear this will never work:
$ ip route get to 192.168.1.1 from 10.110.1.3 iif wlp0s20u1 RTNETLINK answers: No route to host $ ip route get to 220.127.116.11 from 10.110.1.3 iif wlp0s20u1 RTNETLINK answers: No route to host
I noticed the
src 192.168.1.110 on the
192.168.1.0 route, and tried adding the following route to fix this:
$ sudo ip route add 192.168.1.1/32 dev wlp3s0
But this didn't help either.
I used tcpdump to analyze icmp so I can see where my pings are going.
$ tcpdump -i wlp0s20u1 -n icmp listening on wlp0s20u1, link-type EN10MB (Ethernet), capture size 262144 bytes 18:13:19.355166 IP 10.110.1.3 > 18.104.22.168: ICMP echo request, id 32366, seq 1, length 64 18:13:20.359770 IP 10.110.1.3 > 22.214.171.124: ICMP echo request, id 32366, seq 2, length 64
tcpdump -i wlp3s0 -n icmp listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes
Nothing on the wlp3s0 interface unless I ping from the "router" computer.
So clearly the issue here is the kernel does not know to route packets from wlp0s20u1 to wlp3s0. But I am not sure how to make it do this. I've tried explicitly adding routes to tell it to do this, but it doesn't seem to work.
If I spam the following, only the prerouting packet counters go up (while a ping is being attempted);
$ iptables -t nat -v -L -n Chain PREROUTING (policy ACCEPT 775 packets, 50740 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 24 packets, 1920 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 95 packets, 23073 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 5 packets, 1000 bytes) pkts bytes target prot opt in out source destination 90 22073 MASQUERADE all -- * wlp3s0 0.0.0.0/0 0.0.0.0/0
Any help is greatly appreciated!
EDIT: Simplified Explanation
I have three devices:
- A: WiFi router at 192.168.1.1
- B: Computer with two wifi cards: wlp3s0 on the 192.168.1.1 network, and wlp0s20u1 on the 10.110.1.0/24 network.
- C: Computer purely on the 10.110.1.0/24 WiFi network.
I'm trying to allow C to talk to the internet (0.0.0.0/0) with two hops, first to B, then to A, then to the internet.
The issue is getting B to route packets from wlp3s20u1 to wlp3s0.