My Linksys router (IP inside a /24 subnet) is connected to my ADSL modem (IP inside a /24 subnet) to establish an internet connection via PPPoE. To be able to access the modem's webinterface from one of the PCs that are connected to the router, the following commands need to be executed on the router:

ip addr add dev vlan1 brd +
iptables -I POSTROUTING -t nat -o vlan1 -d -j MASQUERADE

As far as I understood this is necessary because the router would otherwise assume the IP to be an external address since it is not part of its own subnet.

But what are these two lines doing exactly? The first one seems to assign a second IP address to the vlan1 interface (which is basically the router's WAN port). The second one apparently modifies the source address of outgoing IP packets. But isn't that exactly what any home router does by default? By using iptables -t nat -L I found that there is already a rule:

target      prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Now the second commands adds

MASQUERADE  all  --  anywhere   

to this table, but isn't this only a more specific version of the above rule and therefore redundant?

It would be great if someone could explain me the details of what's going on here exactly!

Output of ip route:   dev ppp0   proto kernel  scope link  src [my public IP]     dev vlan1  proto kernel  scope link  src  dev br0    proto kernel  scope link  src     dev lo                   scope link
default via dev ppp0

Output of ip addr:

1: lo:  mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet brd scope host lo
2: eth0:  mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
3: eth1:  mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:13:10:2f:fe:4a brd ff:ff:ff:ff:ff:ff
4: vlan0:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
5: vlan1:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:49 brd ff:ff:ff:ff:ff:ff
    inet brd scope global vlan1
6: br0:  mtu 1500 qdisc noqueue
    link/ether 00:13:10:2f:fe:48 brd ff:ff:ff:ff:ff:ff
    inet brd scope global br0
23: ppp0:  mtu 1492 qdisc pfifo_fast qlen 3
    inet [my public IP] peer brd [my public IP] scope global ppp0
  • MOREINFO about your setup is needed. please show the output of ip addr, routel and iptables-save. – BatchyX Apr 20 '13 at 16:41
  • Your modem is problably configured with only the 10/24 subnet routed through its LAN port, so if you try to access your router with a source address in, it may try to route the response to its WAN port or discard the packet. Except to access the internet, your router probably already have an address in the 10/24 range, so that's a bit strange. The MASQUERADE rule also seems unnecessary at first glance, but iptables -L is known to hide some options that can make a huge difference. – BatchyX Apr 20 '13 at 16:49
  • I'm running a modified Tomato firmware which does neither include routel nor iptables-save, sorry. I don't think that my router already has an IP in the modem's range to access the internet, though, because PPPoE is located below the IP layer and therefore does not use any IPs. I found this link which tries to explain. What's still unclear is which IP is copied into the outgoing packets by the MASQERADE rule since the vlan1 has multiple IPs now ( and – ph4nt0m Apr 21 '13 at 8:26
  • apparently, MASQUERADE chooses the address whose subnet contains the next hop's address, or something like that (Not sure why it doesn't just pick up the preferred source address). So that mean 10.1 for 10/24. If routel is not available, show the output of ip rule and ip route. Also show the output of iptables -t nat -S and iptables -S to replace iptables-save – BatchyX Apr 21 '13 at 12:39
  • Unfortunately, ip rule doesn't work and the -S argument of iptables is not known. The firmware contains iptables v1.3.8 which is quite old I assume. Maybe at least ip route and ip addr are of any help, so I added the outputs to the main post. – ph4nt0m Apr 21 '13 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.