linux as router

[kalinix]

On Sun, 2009-12-13 at 22:59 +0100, paul van der meij wrote:

> I don't think that it makes sense to configure a router with one
> physical network card. If another PC on the same cable segment tries
> to reach something it needs a router that has connection with more
> than the same network cable.
> 
> greetings, paul
> 
> 
> 2009/12/13 Adel ESSAFI <adelessafi at gmail.com>
> 
>         Hi list
>         This is the first time I have to configure linux as router.
>         I have a single network card for which I gave to IPs
>         
>         eth0      Link encap:Ethernet  HWaddr 00:11:5B:72:7F:D9  
>                   inet addr:41.231.X.Y  Bcast:41.255.255.255
>         Mask:255.255.255.0
>                   inet6 addr: fe80::211:5bff:fe72:7fd9/64 Scope:Link
>                   UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>                   RX packets:2595 errors:0 dropped:0 overruns:0
>         frame:0
>                   TX packets:2295 errors:0 dropped:0 overruns:0
>         carrier:0
>                   collisions:0 txqueuelen:1000 
>                   RX bytes:1876353 (1.7 MiB)  TX bytes:328059 (320.3
>         KiB)
>                   Interrupt:21 Base address:0x8000 
>         
>         eth0:1    Link encap:Ethernet  HWaddr 00:11:5B:72:7F:D9  
>                   inet addr:192.168.10.10  Bcast:192.168.10.255
>         Mask:255.255.255.0
>                   UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>                   Interrupt:21 Base address:0x8000 
>         
>         
>         
>         
>         and this is the default route 
>         
>         [root at routeur ~]# route
>         Kernel IP routing table
>         Destination     Gateway         Genmask         Flags Metric
>         Ref    Use Iface
>         41.231.2.0      *               255.255.255.0   U     0      0
>         0 eth0
>         192.168.10.0    *               255.255.255.0   U     0      0
>         0 eth0
>         link-local      *               255.255.0.0     U     1002   0
>         0 eth0
>         default         41.231.2.81     0.0.0.0         UG    0      0
>         0 eth0
>         
>         
>         The problem now, is when I configure a PC with an IP adress
>         192.168.10.X  and I put the gateway as 192.168.10.10, I do not
>         succeed to ping any PC. How can I route all the packages from
>         eth0:1 to eth0??
>         
>         
>         note that I have configured the ip forward. 
>         
>         echo 1> /proc/sys/net/ipv4/ip_forward
>         
>         Can you help me please.
>         
>         regards
>         
>         
>         
>         
>         
>         -- 
>         http://ilovefedora.blogspot.com/
>         
>         -- 
>         
>         PhD candidate in Computer Science
>         Address       
>         BP 108, Bureau de poste Tunis republique 
>         1001 Tunis
>         Tunisia
>         tel: +216 97 246 706
>         fax: +216 71 391 166
>         
>         
>         
>         --
>         fedora-list mailing list
>         fedora-list at redhat.com
>         To unsubscribe:
>         https://www.redhat.com/mailman/listinfo/fedora-list
>         Guidelines:
>         http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
> 
> 
> 
> -- 
> fedora-list mailing list
> fedora-list at redhat.com
> To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
> Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


It's called 'router on the stick'. While it can be done on dedicated
routers (I saw this done on CISCO, don't know if it can be done on
Juniper's) it's hard, but not impossible to be done on linux with
iptables.

One problem though is that iptables does not recognize aliases (like
eth0:1). However it can see the traffic on eth0:1 but it will appear as
generated on the same device as eth0. So, if you know iptables good
enough, you can build some iptables rules to redirect the traffic from
internal network to internet. As I said, it's hard, but can be done.
Just google for 'iptables virtual interfaces'.

OTOH, the short answer is: get yourself a second network card - this
will solve your problem.


Calin

Key fingerprint = 37B8 0DA5 9B2A 8554 FB2B 4145 5DC1 15DD A3EF E857

=================================================
Anyone who uses the phrase "easy as taking candy from a baby" has never
tried taking candy from a baby. -- Robin Hood
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20091214/a23d137c/attachment-0001.htm>