1

I have the following network topology, I've tried to ilustrate, so pardon me for bad painting skills.

different subnets

I want to be able to communicate from 10.0.0.0/24 network to 192.168.1.0/28 because I want to set up a logging machine as a virtualbox ran on my LAN, plus few other purposes.

I can access my Firewall from 192.168.1.0/28 network , but I can not do the reverse.

I know that routes must exist in both way in Asus Router which is BusyBox based, but I always fail to add a route.

Here is the routing tables:

    Asus:
/home/root # ip r s
default via 192.168.0.2 dev eth2.2  metric 1 
127.0.0.0/8 dev lo  scope link 
192.168.0.0/24 dev eth2.2  proto kernel  scope link  src 192.168.0.3 
192.168.1.0/28 dev br0  proto kernel  scope link  src 192.168.1.1 



    Firewall:

admin@piwall:~$ ip r s
default via 10.0.0.1 dev eth0  metric 202 
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.2  metric 202 
169.254.0.0/16 dev eth1  proto kernel  scope link  src 169.254.51.49  metric 203 
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.2 
192.168.1.0/28 via 192.168.0.2 dev eth1 

Can someone instruct me how to add routes properly to accomplish my tasks and explain a bit, I would be thankful.

Thanks!

2
  • The eth2.2 on your diagram doesn't really match eth1 on the route dump, though... – user1686 Feb 22 '17 at 8:33
  • Thanks guys for answers, really appreciate. Yes, I've investigated Asus router, and it has F-wall enabled- so i think this is frome where issues are comming from. I'll check your replies – fugitive Feb 22 '17 at 16:05
1

There is one route which is not correct, on the Firewall:

192.168.1.0/28 via 192.168.0.2 dev eth1

should be instead:

192.168.1.0/28 via 192.168.0.3 dev eth1

In other words, the via keyword precedes the IP address of the machine thru which the connection is to be made, your Asus router in this case. You have used instead the IP address of the very same machine from which the connection starts.

For this to work, there are three other conditions, the first one of which is irrelevant to you but I mention it for all those who are configuring a normal pc as a router:

  1. Enable IPv4 forwarding by uncommenting the line

    #net.ipv4.ip_forward=1
    

    in the file /etc/sysctl.conf, and then force this rule with

    sudo sysctl -p
    

    . This is irrelevant to you because your Asus router is already working as a router, hence it surely has this option correctly configured.

  2. Make sure your firewall rules on the Asus router allow connections to flow backwards. You see, routers also protect machines within their LAN by dropping direct communications attempt, unless port forwarding is enabled. But this is too restrictive for you, because you want unlimited access from the Firewall to your LAN. Hence you will need these two rules:

    iptables -a INPUT -s 192.168.0.2 -d 192.168.1.0/24 -j ACCEPT
    iptables -a FORWARD -s 192.168.0.2 -d 192.168.1.0/24 -j ACCEPT
    

    These two rules accept communications (the first one entrance onto the router, the second one transfering it to the internal interface) from only the Pi machine (for obvious security reasons), to any pc in your LAN, irrespective of the ports being used. This is wider than allowing simply some port forwarding.

  3. Your router will be doing NAT, which means that all outgoing packets are rewritten as if they are coming from the Asus router's outer interface, the one with IP address 192.168.0.3. This means that all reply packet to the Pi firewall will appear to be coming from a different IP address than the one to which the initial connection was addressed, and they will thus be discarded by the Pi firewall for obvious security reasons (this situation mimics a man in the middle attack).

    In order to circumvent this problem, you may very well suspend NAT on the Asus only for packets destined to the Pi firewall, as follows:

    iptables -t nat -A POSTROUTING -d 192.168.1.2 -j ACCEPT
    

    For this to work, you need to make sure (by visually checking it with

    iptables -t nat -L -n -v
    

    ) that the above rule is listed before the following rule

    iptables -t nat -A POSTROUTING -j MASQUERADE
    

    The reason is that iptables rules are applied sequentially, until the first rule that applies is found, and then inspection of all following rules is not performed. In this case, making sure that the rules are in this order assures us that packets destined to the Pi firewall will not be rewritten.

3
  • Marius, Yes, you're right, I've added static route on firewall, and now it is working. BTW, I am currently using wan-lan connection from Asus to Firewall. Do you recommend to use lan-lan instead? Thanks again for great post! – fugitive Feb 23 '17 at 9:14
  • 1
    @fugitive Np. If you use lan-lan then the Pi cannot act as a firewall to the Asus, because it is located downstream from it, not upstream. If you only want the Pi to act as a firewall, then there is really no need of it: the Asus has its own firewall, no need to duplicate it. The position of the PI, upstream of your router, is useful only when you wish to run a Detection Intrusion System, like SNORT for instance. Normally, I would do without the Pi... – MariusMatutiae Feb 23 '17 at 10:30
  • Thanks for the advice, I need pi for squid + other stuff, maybe ids latter on. Thanks again! :) – fugitive Feb 23 '17 at 11:19
0

Your routing tables are correct – it's more likely that the Asus router, having been made as a home WAN gateway, has a firewall enabled which blocks all incoming connections. See if you can disable it.

(If the NAT feature is active, you should disable that too. It's probably not the problem here, but it's completely unnecessary to do NAT twice in the same LAN.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.