0

I have a device (IP 10.110.1.3) with the following rule set up:

$ ip route
default via 10.110.1.4 dev wlan0 onlink

I have ipv4 forwarding enabled on both machines. Both machines can talk to each other.

Here is my iptables. I want to route from interface wlp0s20u1 to wlp3s0:

$ iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

$ iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o wlp3s0 -j MASQUERADE

Routes on the "routing" device 10.110.1.4:

$ ip route
default via 192.168.1.1 dev wlp3s0  proto static 
10.110.1.0/24 dev wlp0s20u1  proto kernel  scope link  src 10.110.1.4 
192.168.1.0/24 dev wlp3s0  proto kernel  scope link  src 192.168.1.110  metric 600 

Using the "if interface" route get, it's clear this will never work:

$ ip route get to 192.168.1.1 from 10.110.1.3 iif wlp0s20u1
RTNETLINK answers: No route to host

$ ip route get to 8.8.8.8 from 10.110.1.3 iif wlp0s20u1
RTNETLINK answers: No route to host

I noticed the src 192.168.1.110 on the 192.168.1.0 route, and tried adding the following route to fix this:

$ sudo ip route add 192.168.1.1/32 dev wlp3s0

But this didn't help either.

I used tcpdump to analyze icmp so I can see where my pings are going.

$ tcpdump -i wlp0s20u1 -n icmp
listening on wlp0s20u1, link-type EN10MB (Ethernet), capture size 262144 bytes
18:13:19.355166 IP 10.110.1.3 > 8.8.8.8: ICMP echo request, id 32366, seq 1, length 64
18:13:20.359770 IP 10.110.1.3 > 8.8.8.8: ICMP echo request, id 32366, seq 2, length 64

and

tcpdump -i wlp3s0 -n icmp                                             
listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes

Nothing on the wlp3s0 interface unless I ping from the "router" computer.

So clearly the issue here is the kernel does not know to route packets from wlp0s20u1 to wlp3s0. But I am not sure how to make it do this. I've tried explicitly adding routes to tell it to do this, but it doesn't seem to work.

If I spam the following, only the prerouting packet counters go up (while a ping is being attempted);

$ iptables -t nat -v -L -n

Chain PREROUTING (policy ACCEPT 775 packets, 50740 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 24 packets, 1920 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 95 packets, 23073 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 5 packets, 1000 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   90 22073 MASQUERADE  all  --  *      wlp3s0  0.0.0.0/0            0.0.0.0/0 

Any help is greatly appreciated!

EDIT: Simplified Explanation

I have three devices:

  • A: WiFi router at 192.168.1.1
  • B: Computer with two wifi cards: wlp3s0 on the 192.168.1.1 network, and wlp0s20u1 on the 10.110.1.0/24 network.
  • C: Computer purely on the 10.110.1.0/24 WiFi network.

I'm trying to allow C to talk to the internet (0.0.0.0/0) with two hops, first to B, then to A, then to the internet.

The issue is getting B to route packets from wlp3s20u1 to wlp3s0.

  • If you don't get a resolution to this, I suggest that you clarify the network topology as a whole, the NIC(s) on each PC, and the IP address(es) associated with each NIC, and be in explicit in what settings are on which PC. Other references to your setup are either ambiguous or unstated - you say that both PCs can talk to each other, but you don't actually say what you want to be able to do - I'm guessing access the internet, and further guessing that the WAN gateway is 192.168.1.1 (or on that subnet), but it's not clear if that is a different undiscussed NIC or shared media. – Argonauts Jun 11 '16 at 4:25
  • @Argonauts I wrote a simplified explanation with all of the NICs mentioned. The WAN gateway is 192.168.1.1, yes. Thanks for the help! – Christian Stewart Jun 11 '16 at 20:29
0

The solution was to enable forwarding on the specific interface. It wasn't enabled for some reason.

sudo sysctl net.ipv4.conf.wlp3s0.forwarding=1
sudo sysctl net.ipv4.conf.wlp0s20u1.forwarding=1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.