Home / server / Questions / 400395
Accepted
WhyNotHugo
Asked: 2012-06-20 21:14:24 +0800 CST

Linux as a gateway (no NAT)

  • 772

I'm trying to configure a linux server as a gateway/router, but I can't get it to work, and all information I've managed to find is NAT-related.

I have a public IP block for the gateway and devices behind it, so I want the gateway to simply route packets to the internet - again: no NATing!

I've managed to get the gateway to access the internet successfully (that was just a matter of configuring the IP and GW), and the computers behind it can communicate with it.

[EDIT: more info]

This is actually an IPv6 block (2800:40:403::0/48) (but I've found that most utilities and instructions can be easily adapted from IPv4 to IPv6 with little hastle).

The server has too ports:

  • wan: 2800:40:403::1/48
  • lan: 2800:40:403::3/48

One of the computers behind it is connected to it via a switch;

  • 2800:40:403::7/48

The wan interface on the server can ping6 www.google.com without issues. The lan interface on the server and the client can mutually ping each other without issues (as well as SSH, etc).

I've tried setting the server as a default gateway for the client, with no luck:

client # route -A inet6 add default gw 2800:40:403::3 dev eth1

server # cat /proc/sys/net/ipv6/conf/all/forwarding 
1

I don't want any filtering/firewalling/etc, just plain routing.

Thanks.

linux nat ip route

2 Answers

  1. Is forwarding enabled?

    echo 1 >  /proc/sys/net/ipv4/ip_forward
    • 5
  2. Best Answer

    I assume you have one public IP address for your WAN side, and a block for the LAN side, something like this:

    ISP-----ROUTER ETH0/ROUTER ETH1------SWITCH------PCs

    You NEED to have a public IP address for the WAN interface, ISP will route the subnet they have given you through this IP address

    Simply you need to set the forwarding bit to 1

    echo 1 > /proc/sys/net/ipv4/ip_forward

    To make it persistent you need to edit /etc/sysctl.conf, find this line: 

    net.ipv4.ip_forward=0

    and change it to 

    net.ipv4.ip_forward=1

    Make sure to uncomment it if commented.

    Now, all you need to do is set your pc's default gateway to point to the linux router and assuming the ISP has done their work by routing the block through the public ip address for your lan side.

    Now. If all you have is a public address block... you're not looking into routing, just hook the ISP to a switch and all the PCs to the switch and it should be done. If you can specify more details we might be able to help you more.

    Edit:

    You say your interfaces are configured as follows:

    wan: 2800:40:403::1/48
lan: 2800:40:403::3/48

    What is your default gateway? I guess 2800:40:403::2/48

    It shouldn't really work like this. I haven't worked with IPv6 yet but you have the two interfaces in one subnet, I guess I will allow you to configure that but say a Cisco router would at least warn you about the overlap

    Easiest solution is all the PCs go to a switch connected to the ISP.

    The real solution is tell the ISP to give you 1 public address on their address space for WAN and to route the block through that address. Then all you have to do is configure:

    wan: ip-from-their-space
lan: 2800:40:403::1/48

    And all the lan PCs should point to that one as default.

    You have a very large address space, what you could do is further subnet it.

    Edit:

    If you really want to bridge the interfaces you can do it without anything IP related. You will only have one interface with an IP address that way.

    All you need to do is install bridge-utils, then you configure it this way:

    ip add flush dev eth0
ip add flush dev eth1
brctl addbr br0
brctl addif br0 eth0 eth1
ip link set dev br0 up

    Then configure your IPv6 address on br0 instead and now you have a transparent bridge. It still doesn't solve your IPv4 problem but you could solve it this way:

    Configure IPv4 public and private address on br0, and NAT this way:

    iptables -t nat -A POSTROUTING -j SNAT -s / --to-source

    • 2