Login or Register to Ask a Question and Join Our Community


IP Networking

Dual Router (routing problem)

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums IP Networking Dual Router (routing problem)
# 1  
Old 09-04-2015
Dual Router (routing problem)
This is the network configuration I have:

Code:
          +-------------------------------------------------+   +===========+   
          |                                                 |   |           |   
          |                     INTERNET                    |---| LINUXBOX2 |   
          |                                                 |   |           |   
          +-------------------------------------------------+   +===========|   
               |                                       |                        
               |                                       |                        
          +=========+                             +=========+                   
          |         |                             |         |                   
          | ROUTER1 |                             | ROUTER2 |                   
          |         |                             |         |                   
          +=========+                             +=========+                   
 10.10.100.1|     |10.10.201.254       10.10.202.254|     |10.10.101.1          
            |     |                                 |     |                     
  +-----------+   |                                 |   +-----------+           
  |   VPN1    |   |                                 |   |   VPN2    |           
  |           |   |                                 |   |           |           
  |10.10.100.0|   |                                 |   |10.10.101.0|           
  +-----------+   |     +=====================+     |   +-----------+           
                  |     |      LINUXBOX1      |     |                           
                  |     |                     |     |                           
                  +-----|eth1             eth2|-----+                           
             10.10.201.1|                     |10.10.202.1                      
                        |         eth0        |                                 
                        +=====================+                                 
                                   |10.10.200.1                                
                                   |                                           
                                   |                                           
                             +-----------+                                     
                             | LOCAL NET |                                     
                             |           |                                     
                             |10.10.200.0|                                     
                             +-----------+


where VPN1 and VPN2 are two VPNs managed by the corresponding routers.

Each router has its own public and private IP and they both are gateways to the internet.

LINUXBOX1 is connected to three private networks, and it is itself a gateway to the internet for any LOCALNET machine.

Finally, connected to the internet we also have a road warrior machine (LINUXBOX2).


##########
### Goal ###
##########


My goal is to be able to:

1) ssh from LINUXBOX2 to any of the two routers and be forwarded to LINUXBOX1 in both cases,

2) ping any private IP from a machine connected to any private subnetwork (VPN1, VPN2, LOCALNET).


######################
### Network Configuration ###
######################


# ROUTER1 (asus rtn66u) #


routing table:

10.10.200.0 via 10.10.201.1
10.10.202.0 via 10.10.201.1
10.10.101.0 via 10.10.201.1

port forwarding:

incoming SSH connections forwarded to 10.10.201.1


# ROUTER2 (asus rtac3200) #


routing table:

10.10.200.0 via 10.10.202.1
10.10.201.0 via 10.10.202.1
10.10.100.0 via 10.10.202.1

port forwarding:

incoming SSH connections forwarded to 10.10.202.1


# LINUXBOX1 #

Code:
cat /etc/iproute2/rt_tables

#
# reserved values
#
255	local
254	main
253	default
0	unspec
#
# local
#
#1	inr.ruhep
1 rtac3200

Code:
cat /etc/network/interfaces.d/eth0.cfg

allow-hotplug eth0
iface eth0 inet static
  address 10.10.200.1
  netmask 255.255.255.0

Code:
cat /etc/network/interfaces.d/eth1.cfg

allow-hotplug eth1
iface eth1 inet static
  address 10.10.201.1
  netmask 255.255.255.0
  gateway 10.10.201.254

Code:
cat /etc/network/interfaces.d/eth2.cfg

allow-hotplug eth2
iface eth2 inet static
  address 10.10.202.1
  netmask 255.255.255.0

  ### static routing (part 1) ###
  post-up route add -net 10.10.101.0 netmask 255.255.255.0 gw 10.10.202.254
  pre-down route del -net 10.10.101.0 netmask 255.255.255.0 gw 10.10.202.254

  ### static routing (part 2) ###
  post-up ip route add 10.10.202.0/24 dev eth2 src 10.10.202.1 table rtac3200
  post-up ip route add default via 10.10.202.254 dev eth2 table rtac3200
  post-up ip rule add from 10.10.202.1/32 table rtac3200
  post-up ip rule add to 10.10.202.1/32 table rtac3200


############
### Results ###
############


If I enable "static routing (part 2)" I can ssh into LINUXBOX1 from LINUXBOX2 via either router but any ping coming from VPN1 or LOCALNET to 10.10.202.1 does not get answered.

If I disable "static routing (part 2)" I cannot ssh into LINUXBOX1 from LINUXBOX2 via ROUTER2 but any ping coming from VPN1, VPN2 or LOCALNET to 10.10.202.1 does get answered.


#############
### Question ###
#############


How can I fully achieve my goal?
Last edited by matteo; 09-04-2015 at 01:47 PM..
# 2  
Old 09-04-2015
First, thank you. You've taken the time to document your network, show your problems, and describe your goal quite clearly.

I'm not sure you can forward ssh in that fashion, it has many checks to prevent this kind of diversion since that can be done for insidious purposes as well as benign ones.

I would like to see the output of route -n from the linux boxes and routers.
This User Gave Thanks to Corona688 For This Post:
matteo
# 3  
Old 09-04-2015
Here it is:

Code:
admin@RTN66U:/tmp/home/root# route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
231.111.7.1     0.0.0.0         255.255.255.255 UH    0      0        0 eth0
10.10.202.0     10.10.201.1     255.255.255.0   UG    1      0        0 br0
10.10.100.0     0.0.0.0         255.255.255.0   U     0      0        0 tun21
10.10.200.0     10.10.201.1     255.255.255.0   UG    1      0        0 br0
10.10.201.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
10.10.101.0     10.10.201.1     255.255.255.0   UG    1      0        0 br0
231.111.7.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         231.111.7.1     0.0.0.0         UG    0      0        0 eth0


admin@RTAC3200:/tmp/home/root# route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
231.111.7.1     0.0.0.0         255.255.255.255 UH    0      0        0 vlan2
10.10.202.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
10.10.100.0     10.10.202.1     255.255.255.0   UG    1      0        0 br0
10.10.200.0     10.10.202.1     255.255.255.0   UG    1      0        0 br0
10.10.201.0     10.10.202.1     255.255.255.0   UG    1      0        0 br0
10.10.101.0     0.0.0.0         255.255.255.0   U     0      0        0 tun21
231.111.7.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan2
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         231.111.7.1     0.0.0.0         UG    0      0        0 vlan2


root@LINUXBOX1:/home/root# route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.201.254   0.0.0.0         UG    0      0        0 eth1
10.10.101.0     10.10.202.254   255.255.255.0   UG    0      0        0 eth2
10.10.200.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.10.201.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
10.10.202.0     0.0.0.0         255.255.255.0   U     0      0        0 eth2

BTW, can you suggest me a book/online course where I can learn how to investigate and solve this kind of problems?
Last edited by matteo; 09-04-2015 at 01:52 PM..
# 4  
Old 09-09-2015
Well, I solved it myself by adding an extra network (10.10.200.0/24) to the rtac3200 table:

Code:
cat /etc/network/interfaces.d/eth2.cfg

allow-hotplug eth2
iface eth2 inet static
  address 10.10.202.1
  netmask 255.255.255.0

  ### static routing (part 1) ###
  post-up route add -net 10.10.101.0 netmask 255.255.255.0 gw 10.10.202.254
  pre-down route del -net 10.10.101.0 netmask 255.255.255.0 gw 10.10.202.254

  ### static routing (part 2) ###
  post-up ip route add 10.10.200.0/24 dev eth0 src 10.10.200.1 table rtac3200
  post-up ip route add 10.10.202.0/24 dev eth2 src 10.10.202.1 table rtac3200
  post-up ip route add default via 10.10.202.254 dev eth2 table rtac3200
  post-up ip rule add from 10.10.202.1/32 table rtac3200
  post-up ip rule add to 10.10.202.1/32 table rtac3200

# 5  
Old 09-11-2015
Thanks for letting us know the solution!
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. IP Networking

Router problem or ISP problem ?

Hi everyone, I am experiencing discontinuity of Internet service, this started 1 month ago. Everything worked very well for 1 year of intensive use, but now, I have problems reaching my gateway. The gateway is not my router but a node belonging to my ISP and I share the same public IP with... (3 Replies)
Discussion started by: remic
3 Replies

2. Solaris

Routing problem

Hi, I have two physical interfaces on a servers. We have connected them to differerent subnets. 1) First interface: 10.158.49.87 to newtwork 10.158.49.0, its gateway is 10.158.49.1 (It is added as default gateway) It is existing set up. It works well 2) Second interface: ... (1 Reply)
Discussion started by: sri243
1 Replies

3. IP Networking

routing problem/question

Internet Gateway 192.168.0.201 Server 1 192.168.0.101 192.168.1.101 192.168.2.101 gateway: 192.168.0.201 VIP: 192.168.1.100 VIP: 192.168.2.100 Server 2 192.168.0.102 192.168.1.102 192.168.2.102 gateway: 192.168.0.201 Client 1 192.168.2.201 gateway: 192.168.2.100 (1 Reply)
Discussion started by: hopfensp
1 Replies

4. AIX

Aix Routing Problem

I need the following solution , please help me... Current situation ip: 192.168.0.12 persistent and 192.168.254.12 service ip gateway: 192.168.0.254 subnet: 255.255.255.0 i have added a new ip on a new nic ip: 10.10.255.40 gateway: 10.10.255.62 subnet: 255.255.255.224 ... (1 Reply)
Discussion started by: rajibimran
1 Replies

5. Slackware

Slackware router problem

I have a Slackware box that I've set up as a router for my home network. It does that and zoneminder and that's pretty much it. It's worked fine for a few years doing this until today. Today the power went out and the UPS could only keep this machine up for about 45 mins before it ran out of... (1 Reply)
Discussion started by: orsty9001
1 Replies

6. Linux

routing rules for dmz in debian router.

Hi to all. There are eth0(wan) eth1(lan) and eth3(dmz) in my debian router. In dmz is planing dns, ad, dhcp, smtp/pop/imap, https(web-based imap client). I don't configured rules on "iptables" and "route" loads for right relation lan clients with dmz services. Please explain me example... (0 Replies)
Discussion started by: sotich82
0 Replies

7. IP Networking

DI-524 router problem

Hello all, I recently bought D-link (DI-524) router and I have following problem. I setup the network and its running smoothly no problem.. but there is a minor problem that I need to solve. Users can access each other documents etc. but they cannot access each other trough web browser using IP... (1 Reply)
Discussion started by: c0mrade
1 Replies

8. IP Networking

Routing Problem

I have a question concerning networking. Could any forum members explain to me why I might be getting "no route to host" messages when I try to connect through ftp and http protocols? I have went to my etc/hosts file and everything seems to be configured properly. I can connect within my... (1 Reply)
Discussion started by: cstovall
1 Replies

9. IP Networking

routing problem

following Problem. I configured my SuSE Linux 8.0 as a router. I4l, named, ip_forward, iptables (NAT/MASQUERADING) are running or are aktivatet. I just can get a internet connection about the proxy server squid, but if i want to use other protocols i need functional routing. (I had this... (1 Reply)
Discussion started by: razor
1 Replies

10. IP Networking

Routing problem

Hi I know this problem is more likely some windows problem but it has also something to do with unix. We have a windows nt environment wich uses AIX (unix) machines as file servers (samba). In our windows network environment we nicely see al the unix file servers via the 10 MB network. Last... (2 Replies)
Discussion started by: Mark Detrez
2 Replies
Login or Register to Ask a Question