3

I'm trying to configure a linux server as a gateway/router, but I can't get it to work, and all information I've managed to find is NAT-related.

I have a public IP block for the gateway and devices behind it, so I want the gateway to simply route packets to the internet - again: no NATing!

I've managed to get the gateway to access the internet successfully (that was just a matter of configuring the IP and GW), and the computers behind it can communicate with it.

[EDIT: more info]

This is actually an IPv6 block (2800:40:403::0/48) (but I've found that most utilities and instructions can be easily adapted from IPv4 to IPv6 with little hastle).

The server has too ports:

  • wan: 2800:40:403::1/48
  • lan: 2800:40:403::3/48

One of the computers behind it is connected to it via a switch;

  • 2800:40:403::7/48

The wan interface on the server can ping6 www.google.com without issues. The lan interface on the server and the client can mutually ping each other without issues (as well as SSH, etc).

I've tried setting the server as a default gateway for the client, with no luck:

client # route -A inet6 add default gw 2800:40:403::3 dev eth1

server # cat /proc/sys/net/ipv6/conf/all/forwarding 
1

I don't want any filtering/firewalling/etc, just plain routing.

Thanks.

WhyNotHugo
  • 247
  • 3
  • 12
  • so you want to have public ips behind the linux machine? – Mike Jun 20 '12 at 05:17
  • Yes; the linux server in question would have (at least) on of the public IPs assigned to it, as would the other machines. They should all route through the server it to the internet. – WhyNotHugo Jun 20 '12 at 05:18
  • 1
    @Hugo What's the subnet configuration look like on the internet-facing side of your routing device? – Shane Madden Jun 20 '12 at 05:44

2 Answers2

5

Is forwarding enabled?

echo 1 >  /proc/sys/net/ipv4/ip_forward
user9517
  • 115,471
  • 20
  • 215
  • 297
Laurentiu Roescu
  • 2,266
  • 17
  • 17
2

I assume you have one public IP address for your WAN side, and a block for the LAN side, something like this:

ISP-----ROUTER ETH0/ROUTER ETH1------SWITCH------PCs

You NEED to have a public IP address for the WAN interface, ISP will route the subnet they have given you through this IP address

Simply you need to set the forwarding bit to 1

echo 1 > /proc/sys/net/ipv4/ip_forward

To make it persistent you need to edit /etc/sysctl.conf, find this line: 

net.ipv4.ip_forward=0

and change it to 

net.ipv4.ip_forward=1

Make sure to uncomment it if commented.

Now, all you need to do is set your pc's default gateway to point to the linux router and assuming the ISP has done their work by routing the block through the public ip address for your lan side.

Now. If all you have is a public address block... you're not looking into routing, just hook the ISP to a switch and all the PCs to the switch and it should be done. If you can specify more details we might be able to help you more.

Edit:

You say your interfaces are configured as follows:

wan: 2800:40:403::1/48
lan: 2800:40:403::3/48

What is your default gateway? I guess 2800:40:403::2/48

It shouldn't really work like this. I haven't worked with IPv6 yet but you have the two interfaces in one subnet, I guess I will allow you to configure that but say a Cisco router would at least warn you about the overlap

Easiest solution is all the PCs go to a switch connected to the ISP.

The real solution is tell the ISP to give you 1 public address on their address space for WAN and to route the block through that address. Then all you have to do is configure:

wan: ip-from-their-space
lan: 2800:40:403::1/48

And all the lan PCs should point to that one as default.

You have a very large address space, what you could do is further subnet it.

Edit:

If you really want to bridge the interfaces you can do it without anything IP related. You will only have one interface with an IP address that way.

All you need to do is install bridge-utils, then you configure it this way:

ip add flush dev eth0
ip add flush dev eth1
brctl addbr br0
brctl addif br0 eth0 eth1
ip link set dev br0 up

Then configure your IPv6 address on br0 instead and now you have a transparent bridge. It still doesn't solve your IPv4 problem but you could solve it this way:

Configure IPv4 public and private address on br0, and NAT this way:

iptables -t nat -A POSTROUTING -j SNAT -s / --to-source

mmlb
  • 103
  • 3
Radius
  • 559
  • 2
  • 9
  • The ISP has given me just a block - are you saying I can't route this through just one server? The problem is I have a IPv6 block, but a single IPv4 address, and some clients will be NATed when it comes to IPv4, but all clients should get their own IPv6. – WhyNotHugo Jun 20 '12 at 08:17
  • 1
    If you are not using nat nor firewalling the server is not needed. Now if you need it for IPv4. See my edit above. – Radius Jun 20 '12 at 15:16
  • You are quite right; what I need is more switch-like (an IPv6 network bridge to be precise). As a side note, /48 is the standard IPv6 block size for ISPs to give to clients, so as to avoid NATing ever again in the future. :) – WhyNotHugo Jun 20 '12 at 19:31
  • 1
    Well you need a common switch... bridging doesn't have anything to do with the IP version and you can do it easily with your own box by installing bridge-utils, I'll update the answer with that info. – Radius Jun 20 '12 at 19:36