0

I have a server with 2 network cards. I want to route from the 192.168.0.0/24 network to the 192.168.112.0/24 network and back the same way. What am I doing wrong? I have already set forwarding. See below

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:07:32:79:e1:2d brd ff:ff:ff:ff:ff:ff
    inet 192.168.112.251/24 brd 192.168.112.255 scope global noprefixroute enp1s0
       valid_lft forever preferred_lft forever
    inet6 fe80::207:32ff:fe79:e12d/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:07:32:79:e1:2c brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.21/24 brd 192.168.0.255 scope global noprefixroute enp0s31f6
       valid_lft forever preferred_lft forever
    inet6 fe80::207:32ff:fe79:e12c/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

Here is the Firewall:

nft list ruleset

table ip nat { chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; counter packets 2552 bytes 466059 jump WEBSERVER_PREROUTING }

    chain OUTPUT {
            type nat hook output priority -100; policy accept;
            counter packets 752 bytes 71689 jump WEBSERVER_OUTPUT
    }

    chain WEBSERVER_PREROUTING {
            tcp dport 80 counter packets 61 bytes 3172 meta mark set 0x0005face
            tcp dport 80 counter packets 61 bytes 3172 redirect to :8080
            tcp dport 443 counter packets 0 bytes 0 meta mark set 0x0005face
            tcp dport 443 counter packets 0 bytes 0 redirect to :8181
    }

    chain WEBSERVER_POSTROUTING {
    }

    chain WEBSERVER_OUTPUT {
            oifname "lo" tcp dport 80 counter packets 0 bytes 0 redirect to :8080
            oifname "lo" tcp dport 443 counter packets 14 bytes 728 redirect to :8181
    }

    chain INPUT {
            type nat hook input priority 100; policy accept;
    }

    chain POSTROUTING {
            type nat hook postrouting priority srcnat; policy accept;
    } } table ip filter {
    set DENYLIST {
            type ipv4_addr
            flags interval
    }

    chain INPUT {
            type filter hook input priority filter; policy accept;
            counter packets 148804 bytes 44992337 jump ATTACKER-DETECTION
            counter packets 148804 bytes 44992337 jump RH-FIREWALL-1-INPUT
            counter packets 59434 bytes 26101045 jump DYNAMIC-PORTS
            ct state established,related counter packets 56789 bytes 25666535 accept
            ip protocol icmp counter packets 2 bytes 128 accept
            iifname "lo" accept
            ct state new tcp dport 22 counter packets 1 bytes 52 accept
            counter packets 2121 bytes 406163 reject with icmp type host-prohibited
            counter packets 0 bytes 0 drop
    }

    chain FORWARD {
            type filter hook forward priority filter; policy accept;
    }

    chain OUTPUT {
            type filter hook output priority filter; policy accept;
    }

    chain ATTACKER-DETECTION {
            ip saddr @DENYLIST drop
    }

    chain RH-FIREWALL-1-INPUT {
            ct state new tcp dport 8181 meta mark 0x0005face counter packets 0 bytes 0 accept
            ct state new tcp dport 8080 meta mark 0x0005face counter packets 61 bytes 3172 accept
            tcp dport 3090 counter packets 0 bytes 0 accept
            udp dport 3090 counter packets 0 bytes 0 accept
            tcp dport 5060 counter packets 0 bytes 0 accept
            udp dport 5060 counter packets 2636 bytes 1871597 accept
            tcp dport 5061 counter packets 0 bytes 0 accept
            udp dport 5061 counter packets 0 bytes 0 accept
            tcp dport 5222 counter packets 386 bytes 20195 accept
            tcp dport 5223 counter packets 0 bytes 0 accept
            tcp dport 50080 counter packets 1838 bytes 145048 accept
            tcp dport 50081 counter packets 0 bytes 0 accept
            udp dport { 10000-20000 } counter packets 84448 bytes 16851228 accept
            ip saddr 10.0.0.0/8 ct state new tcp dport 5038 counter packets 0 bytes 0 accept
            ip saddr 172.16.0.0/12 ct state new tcp dport 5038 counter packets 0 bytes 0 accept
            ip saddr 192.168.0.0/16 ct state new tcp dport 5038 counter packets 1 bytes 52 accept
            ip saddr 10.0.0.0/8 ct state new tcp dport 5038 counter packets 0 bytes 0 accept
            ip saddr 172.16.0.0/12 ct state new tcp dport 5038 counter packets 0 bytes 0 accept
            ip saddr 192.168.0.0/16 ct state new tcp dport 5038 counter packets 0 bytes 0 accept
    }

    chain DYNAMIC-PORTS {
            ct state new udp dport 123 counter packets 25 bytes 1900 accept
    } } table ip6 filter {
    chain INPUT {
            type filter hook input priority filter; policy drop;
            ct state invalid counter packets 0 bytes 0 drop
            ct state established,related counter packets 4448 bytes 3102896 accept
            iifname "lo" counter packets 183 bytes 31252 accept
            iif != "lo" ip6 daddr ::1 counter packets 0 bytes 0 drop
    }

    chain FORWARD {
            type filter hook forward priority filter; policy drop;
    }

    chain OUTPUT {
            type filter hook output priority filter; policy drop;
            oifname "lo" counter packets 4631 bytes 3134148 accept
    } }

[root@root~]# sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

dima1002
  • 1

0 Answers0