0

This is my first post, so thanks in advance for y'all's help. I'll try to keep the background succinct and relevant.

I am running a server on centOS 4.6 for network client testing. I have the local 10.2.80.X/24 network space reserved for myself. The server has a total of 4 ethernet ports:

  • (1) built-in 2-port NIC (wan0 and lan0)
  • (1) PCI 2-port expansion NIC (lan1 and vid0)

My goal is to allow the various 10.2.80.X subnets (64 in total) to communicate with each other, as well as other internal resources on the 10.2.82.X network. Below is a link to my rough network diagram.

NETWORK DIAGRAM

I can get the various 10.2.80.X subnets to talk with each other rather easily. However, I absolutely cannot get traffic going into lan0 to egress from wan0 into the greater corporate network:

  • Test_dev_1 can ping its subnet gateway at 10.2.80.1 (on the server's virtual interface).
  • Test_dev_1 can ping Test_dev_2
  • Test_dev_1 can ping the wan0 port itself (10.2.82.195)
  • Test_dev_1 CANNOT ping anything beyond that on the 10.2.82.X network. I can't ping the 10.2.82.1 gateway and can't ping 8.8.8.8 (google.com).

The wan0 port has full access to the 10.2.82.X network, but can't traverse through lan0 port:

  • Can ping the gateway 10.2.82.1
  • Can ping google.com (8.8.8.8)
  • Can ping all addresses on the lan0 interface (10.2.80.1, 10.2.80.5, etc.)
  • CANNOT ping any client devices on any of the 10.2.80.X subnets.

I've enabled IP forwarding, tried adding various FORWARD rules in iptables, disabled NetworkManager, changed gateways, double-checked my subnet masks, etc. etc. etc. I am out of ideas, my co-workers are out of ideas. I am stuck and deadlines are approaching, so I'm going crazy right now.

I'm open to any suggestions, but I have tried a lot of the common remedies.

Thanks!

radicalrad
  • 5
  • 2

1 Answers1

1

The problem can be at two different layers:

  • at the forwarding level: ipforwarding can be disabled, or iptables rules be misconfigured

  • at the routing level: your corporate network must be informed that the various 10.2.80.x networks can be reached via IP 10.2.82.195. If this is not possible, you had to "masquerade" (NAT) yours 10.2.80.x network using the wan0 interface IP (10.2.82.195).

I suggest you to do the following:

1) on your Linux box, run the command tcpdump -i any icmp host 10.2.82.1

2) on a 10.2.80.x machine, try to ping the 10.2.82.1 IP.

While you stated that the ping does not work, the tcpdump on your Linux box will log the traffic flow. Copy it and paste it here.

shodanshok
  • 44,038
  • 6
  • 98
  • 162
  • Thanks Shodanshok! I found a tutorial on NAT configuration and that cleared everything up immediately. I didn't want to mess with the corporate router settings, so NAT ended up being a better solution for me anyway. – radicalrad Apr 09 '15 at 22:20
  • Glad to hear that ;) – shodanshok Apr 10 '15 at 05:46