One thing about that "net.ipv4.ip_forward=1" - it applies to routable IPv4 networks. The two networks you are using are members of "192.168.xx.xx" networks, and these are NOT routable.

You CAN use iptables to route these, but it is usually (not always) done as part of NAT. NAT makes this easier in one direction (from "behind the NAT" to outside) but this imposes a NAT behind a NAT type of thing - doable, but a pain as it doesn't allow the middle network to access behind the lower level NAT.

And no, I haven't done such routing without using masquerading.

Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.


Thanks and Best Regards

You will need to configure iptables because you'll have to tell the router where the packages should go. Also you need NAT.

You should read more about iptables and understand that it is not only "the firewall" but also manages routing, or in other words, a firewall is nothing but "routingrules".

Markus

I believe that is what it is used for. The only IP numbers not routed would be the non-routable ones.

I think this is how the Quality of Service functions are handled by iptables. By default the only thing governing the routing are the specified routes set via the "route" utility.

When I was working, this function was normally handled by the Cisco (and other vendors) routers rather than by a host. So most of my experience with it was by NAT for isolating a test machine from a network, where the test machine was being targeted for use on another network. This allowed me to test everything as if the machine was in its targeted environment, without actually being in the target environment. Installation was a "drop in" and plug-it-in - taking only seconds to accomplish. I have replaced entire Kerberos environments with such a drop in without anyone noticing I had replaced the KDC. (I found it much safer to update the OS and Kerberos that way than the usual way of updating the backup... not good to have a "test" backup server when/if the primary fails for some reason.)

Okay, so now that we've established what problem we're chasing, I'm going to say that the solution is definitively not as simple as setting one or two kernel parameters (like net.ipv4.ip_forward = 1). A quality solution that covers all of the bases and does not leave security problems or maintenance problems involves quite a number of iptables rules, as well as sundry other settings. As someone correctly pointed out, a router and a firewall are really just two names for the same thing in this context.

procfs should use a tool made for the purpose of developing and deploying the correct collection of iptables rules. This may be in the form of GUI-based firewall creator, or a canned package of iptables rules and configurations as one or more shell scripts. These systems have been developed by people with significant expertise and experience, and have been used and refined by a cast of millions over a period of time. Having said this, I have no personal experience with the style of router that is needed here. Most or at least many packages for building firewalls/routers are geared toward the home or small business scenario, where the objective is to attach a local LAN to a single internet connection.

I'm not sure of the implications of routing between two local private networks, but I'm sure that there is a package that provides for configuration of LAN-LAN routing. I will leave it to others to suggest something. Meanwhile, it would be very very helpful if the OP could describe fully and unambiguously, the organization of the networks involved, the network interfaces of the router host, and what connectivity is desired, as well as what connectivity is to be prohibited.

--- rod.

It would actually be easier to make the Linux system a bridge between two segments of the same private network... I'm not sure, but it may be possible to define the bridge to use the network 192.168.0.0 network - and thus pass both subnets to the other side. It isn't a good solution as you may as well just use one private network instead.

Private networks were set aside specifically for use in test/development environments, to ensure that that network traffic NOT get broadcast. I have seen the 10.x.x.x private network used for large clusters... Routing between two such clusters is done using public IP numbers assigned to the public interfacing nodes. And you don't get arbitrary node from cluster a to node on cluster b connections.

Hi Guys, I was able to fix the problem "the system was not routing across networks" it was my fault not checking routing in our main Internet router "Simply there was no return path" when I add the route to the gateway router, pointing how to reach our privet 11 range things stared working :). Such a trivia thing, yet I failed to see :(. Now I need to setup the Iptabes and get the firewall going

Thank you all for helping me.

Thank you and Best Regards