Routing Issue between 2 interfaces with netplan in Ubuntu 22.04

THawk254 · 10-18-2023, 01:18 AM

I'm trying to build an edge firewall using Ubuntu Server 22.04. The box has 2 physical interfaces but for some reason I can't seem to get anything on the public facing interface:

Internal: 192.168.20.137/24 with no default gw.
External: 1.1.1.140/29 with gw of 1.1.1.137

I can't seem to get traffic to flow through the public interface.

EDIT: IP Forwarding is on.

If I need to update the machine, I use the old gateway but obviously that's not a solution...

Contents of the yaml file below:

Code:

network:
  version: 2
  renderer: networkd
  ethernets:
    enp4s0:
      addresses: [192.168.20.137/24]
        #routes:
        #- to: 0.0.0.0/0
        #  via: 192.168.20.197
      nameservers:
        addresses: [192.168.20.192,192.168.20.182]
    enp3s0:
      addresses: [1.1.1.140/29]
      routes:
      - to: 0.0.0.0/0
        via: 1.1.1.137
      nameservers:
        addresses:
        - 8.8.8.8

Code:

root@severussnape:/etc/netplan# ip r s
default via 1.1.1.137 dev enp3s0 proto static 
192.168.20.0/24 dev enp4s0 proto kernel scope link src 192.168.20.137 
1.1.1.1/29 dev enp3s0 proto kernel scope link src 1.1.1.140

Code:

root@severussnape:/etc/netplan# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 10:62:eb:34:5a:89 brd ff:ff:ff:ff:ff:ff
    inet 1.1.1.140/29 brd 210.4.125.143 scope global enp3s0
       valid_lft forever preferred_lft forever
    inet6 fe80::1262:ebff:fe34:5a89/64 scope link 
       valid_lft forever preferred_lft forever
3: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 04:d4:c4:53:c0:96 brd ff:ff:ff:ff:ff:ff
    inet 192.168.20.137/24 brd 192.168.20.255 scope global enp4s0
       valid_lft forever preferred_lft forever
    inet6 fe80::6d4:c4ff:fe53:c096/64 scope link 
       valid_lft forever preferred_lft forever

Person_1873 · 10-19-2023, 01:05 AM

I've never used netplan, but i've set up linux routers using iptables.
It used to be that you needed to enable masquerading so that the router could perform Network Address Translation (NAT)
I would assume that there is some parallel here.

I've done a little bit of googling and found this. hopefully this is helpful
https://unix.stackexchange.com/quest...eate-a-gateway

elgrandeperro · 10-29-2023, 01:04 PM

You probably get to the default gateway, you probably can ping it. ISPs will not route private IP space, they will drop it. So if you look at netstat or equivalent, you probably are forwarding but it is being dropped. OH that is why you need to masquerade/NAT it.

pingu_penguin · 10-30-2023, 08:57 AM

Have you tried pinging a site from your internet-facing interface ?

What is the output of :

# ping -I enp3s0 google.com

How are you forwarding ? iptables ? or kernel settings based routing ?

Should things not work for you with ping. Try adding a route to your enp3s0 (your public interface) :

# route add -net 0.0.0.0 netmask 0.0.0.0 dev enp3s0

Then try ping and let us know.