# How-To: Create route between 2 interfaces

## Paris Heng

HELP!!!

Can you check again my network? My network setup figure available at:-

http://www.geocities.com/fy_heng/Network.JPG [Please ZooM for clearer image]

Overall I am building an simple access point. 

1. IP Forwarding part:

 *Quote:*   

> echo 1 > /proc/sys/net/ipv4/ip_forward

 

 *Quote:*   

> cd /etc/sysctl.conf
> 
> net.ipv4.conf.forwarding=1

 

2. Routing Table in Linux based Box:

 *Quote:*   

> root@heng:/home/heng# route -n 
> 
> Kernel IP routing table 
> 
> Destination     Gateway         Genmask              Flags Metric Ref    Use    Iface 
> ...

 

3. Windows based Desktop side:

From the figures, the Windows based Desktop is connected to the access point (AP) through static configuration at IP = 192.168.20.3 / 24, GW = 192.168.20.2. It not able to surf net. From Windows prompt, it able to ping all the interfaces at the Linux based Box, it able to ping 192.168.20.3 (itself), 192.168.20.2 and 192.168.10.2. It mean there are a connectivity at a whole. But my problem now, is on the Linux based Box, see below:-

4. Linux based Box side:

From the figures, the laptop have 2 interfaces. One is ath0 that configured as an access point and eth0 is a Ethernet that connect to my home ADSL. It able to surf net. From the laptop itself, I able to ping 192.168.10.2 and 192.168.20.2. But, I not able to ping 192.168.20.3 (the client Windows based desktop). Why I able to ping from Windows side, and not able to ping from the Linux side to the client interface?

 *Quote:*   

> root@heng:/home/heng# ping 192.168.10.2
> 
> PING 192.168.10.2 (192.168.10.2) 56(84) bytes of data. 
> 
> 64 bytes from 192.168.10.2: icmp_seq=1 ttl=64 time=0.083 ms 
> ...

 

r *Quote:*   

> oot@heng:/home/heng# ping 192.168.20.2
> 
> PING 192.168.20.2 (192.168.20.2) 56(84) bytes of data. 
> 
> 64 bytes from 192.168.20.2: icmp_seq=1 ttl=64 time=0.080 ms 
> ...

 

 *Quote:*   

> root@heng:/home/heng# ping 192.168.20.3
> 
> PING 192.168.20.3 (192.168.20.3) 56(84) bytes of data. 
> 
> From 192.168.20.2 icmp_seq=2 Destination Host Unreachable 
> ...

 

It give Destination Host Unreachable.

Anything wrong on the interface IP configuration or routing table? or I must use the Linux for Desktop other than Windows based? Do I need to perform the IP Masquerade? I just want to ping from the Linux side to the 192.168.20.3

Some one please assist.Last edited by Paris Heng on Sun Aug 19, 2007 9:08 pm; edited 1 time in total

----------

## NeddySeagoon

Paris Heng,

Do you want a router, that does Network Address Translation (NAT) between the interaces, provides a DHCP server for the NAT side .. or do you only want to forward packets from one interface to the other ?

For the router follow that link.

For packet forwarding, look in  /etc/sysctl.conf.  you need kernel support and net.ipv4.ip_forward = 1.

If your kernel is ok, the command  

```
echo "1" >/proc/sys/net/ipv4/ip_forward
```

turns forwarding on.

You can read that value too, to see what its set to now.

----------

## tipp98

As Jesu explains in another topic

 *Quote:*   

> Windows XP Network Bridging is equivalent to Proxy ARP routing on linux, not to bridging. It's a question of levels. Linux bridging copies the raw ethernet frames which appear on either side to the other side, without looking at them at all. Thus, the linux box only needs IP address, because the two adapters are merged into one big one.
> 
> However, this doesn't work if the two sides have different raw ethernet standards - eg. 802.3 Ethernet and 802.11b Wireless Ethernet. So, Proxy ARP uses two seperate IP addresses for two interfaces, and you instruct it which IPs are on which interface. Then, for any packet which appears on one side (eg. eth0), if the machine recognises the IP as one of those on the other side (eg. eth1) it claims to be that machine, and passes it on through the other network layer. Because it's bridging at the IP layer, it cuts across different ethernet protocols. This is what Win XP does when it says 'Network Bridge'.

 

I too am trying to connect an Ethernet interface with a wireless interface.  

 *Quote:*   

> For packet forwarding, look in /etc/sysctl.conf. you need kernel support and net.ipv4.ip_forward = 1. 

 

Is this "Proxy ARP routing" you speak of? If not or if so could you elaborate on where to find or verify support for sysctl.conf in the kernel. I found CONFIG_SYSCTL=y in my .config file under general setup but am unable to find it using menuconfig giving doubt as to wether or not I actually have support. I have net.ipv4.ip_forward = 1 in my /etc/sysctl.conf and /proc/sys/net/ipv4/ip_forward reads 1 but I'm not able to run dhcp on the downstream computer.

----------

## NeddySeagoon

tipp98,

On the system that has two interfaces, post the output of 

```
route -n
```

 and the content of /etc/conf.d/net.

----------

## tipp98

route -n

```
Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.0.0     0.0.0.0         255.255.255.0   U     2000   0        0 ath0

127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

0.0.0.0         192.168.0.1     0.0.0.0         UG    2000   0        0 ath0
```

/etc/conf.d/net

```
config_eth0=( "null" )

config_eth1=( "null" )

essid_ath0="Russ"

key_Russ="key"

modules_ath0=( "iwconfig" )

config_ath0=( "dhcp" )

dhcpcd_ath0="-t 10"
```

eth0 is not actually used, it was replaced by eth1. I realize I will need an address for eth1. Is there an automatic way of giving it the same IP as ath0 when dhcp used?

----------

## NeddySeagoon

tipp98,

No two interfaces can be in the same subnet, which excludes the possibility of identical IPs too.

If you bring up your wired interface and look at route -n  you will see why.

Apply the routing rules in order. You will notice that all packets going to the local subnet will alway use the same interface.

Worse, you now have two default routes. Only the first listed one will ever be used.

It you want to have two logical interfaces in the same subnet, you must manage them so that only one is up at a time.

ifplugd helps here.

You may also operate your two (or more) physical interfaces as a single logical interface with a single IP.

The logical interface gets the IP, not the underlying physical parts. This arrangement is called a bond. Bonding can be used to increase bandwidth, provide redundancy or provide a fallback in case the preferred part of the bond fails.

Bonding needs kernel support and some different setup steps in /etc/conf.d/net, since you must donate the physical interfaces to the bond before you run dhcp on the bond to get an IP address. Read /etc/conf.d/net.example

I've not set up a bond yet.

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> tipp98,
> 
> No two interfaces can be in the same subnet, which excludes the possibility of identical IPs too.
> 
> If you bring up your wired interface and look at route -n  you will see why.
> ...

 

Yes. I just want to forward the packet between the ath0 and the eth0. But it did not. 

Hey, you mean the 2 interfaces cannot be in the same subnet? why? I have set them as 2 same subnet. 192.168.10.0

----------

## Paris Heng

This is my overall configuration:-

eth0 (Ethernet on Linux box) 

 *Quote:*   

> ip addr = 192.168.10.2 / 24 , gateway = 192.168.10.1

 

ath0 (Wireless card on Linux box configured as Access Point) 

 *Quote:*   

> no setting

 

PC  (Wireless on Windows) = Client connect to ath0 wirelessly 

 *Quote:*   

> 192.168.10.4 /24 , gateway 192.168.10.5

 

The ath0 is actually configured as an Access Point. A PC is connect to the access point. The PC is able to connect the access point. Status = connected. I try to bridge this 2 interfaces through routing and ip forwarding, but nothing happen, the PC (Windows) cannot use the Internet service. I able to ping 192.168.10.2 (eth0 interface).

Overall configuration:-

IP Forwarding part:

 *Quote:*   

> echo 1 > /proc/sys/net/ipv4/ip_forward

 

 *Quote:*   

> cd /etc/sysctl.conf

 

 *Quote:*   

> net.ipv4.conf.forwarding=1

 

Routing part:

 *Quote:*   

> route add default gw 192.168.10.1 dev eth0
> 
> route add -net 192.168.10.0 netmask 255.255.255.0 dev eth0
> 
> route add -net 192.168.10.0 netmask 255.255.255.0 dev ath0

 

Notes: I have made this 2 interfaces into the same subnet, 192.168.10.0.

Still any wrong? Can't get connect. Thanx.Last edited by Paris Heng on Sun Aug 19, 2007 3:49 pm; edited 1 time in total

----------

## NeddySeagoon

Paris Heng,

Two interfaces cannot be in the same subnet because of the way routing works.

Set up your interfaces in the same subnet and run route -n.

Only the first listed interface (where there is a choice) will ever be used.

There is one exception to this, where one of the interfaces provides a PPP link.

Thats not generally useful, as the far end can have at most, one device connected.

----------

## Paris Heng

 *Paris Heng wrote:*   

> This is my overall configuration:-
> 
> eth0 (Ethernet on Linux box) 
> 
>  *Quote:*   ip addr = 192.168.10.2 / 24 , gateway = 192.168.10.1 
> ...

 

----------

## NeddySeagoon

Paris Heng, 

If you choose seperate subnets for the wired and wireless, it looks like it should work

Set the default gateway to the next hop towards the internet in all cases.

You may need a static route to the other subnet, in each side.

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> Paris Heng,
> 
> Two interfaces cannot be in the same subnet because of the way routing works.
> 
> Set up your interfaces in the same subnet and run route -n.
> ...

 

yes. the routing table have appeared PPP interface which is my ADSL. Then how? Do that mean my eth0 not able to get the Internet packets from ADSL? Do you mean the PPP is an exception?

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> Paris Heng, 
> 
> If you choose seperate subnets for the wired and wireless, it looks like it should work
> 
> Set the default gateway to the next hop towards the internet in all cases.
> ...

 

OK, i will try on it later. How to set the static route to the other subnet, in each side ? It is same like route add ..... 

Thanx you very much for your information.  Highly appreciated.

----------

## NeddySeagoon

Paris Heng,

Yes its just like route add

/etc/conf,d/net.example shows how to write it in your net file

----------

## tipp98

I've tried about every combination of net destinations and gateways that I can think of but still no go. The following doesn't work but what I believe to be the closest thing to right.

```
Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 ath0

127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

0.0.0.0         192.168.0.1     0.0.0.0         UG    2000   0        0 ath0
```

the following is my setup

```

            router               ath0         eth1               winbox

ISP-------192.168.0.1)))   (((192.168.0.124|192.168.1.10-------192.168.1.44
```

ifconfig >

```
ath0      Link encap:Ethernet  HWaddr 00:15:E9:72:83:59  

          inet addr:192.168.0.124  Bcast:192.168.0.255  Mask:255.255.255.0

          inet6 addr: fe80::215:e9ff:fe72:8359/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:954 errors:0 dropped:0 overruns:0 frame:0

          TX packets:381 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:309141 (301.8 Kb)  TX bytes:52271 (51.0 Kb)

eth1      Link encap:Ethernet  HWaddr 00:10:A4:BF:EA:01  

          inet addr:192.168.1.10  Bcast:192.168.1.255  Mask:255.255.255.0

          inet6 addr: fe80::210:a4ff:febf:ea01/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:547 errors:0 dropped:0 overruns:0 frame:0

          TX packets:98 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:52884 (51.6 Kb)  TX bytes:8205 (8.0 Kb)

          Interrupt:11 Base address:0x1000
```

```
/proc/sys/net/ipv4/ip_forward = 1
```

winbox

```

IP:192.168.1.44

netmask:255.255.255.0

gateway:192.168.1.10
```

I can ping both ways on the linux box, (to .1.44 and to .0.1) and I can ping .1.10 from the winbox, but not .0.1.  With all the different setups I've tried, I really believe the port forwarding is what is broke. Any other ideas?

----------

## Paris Heng

Dear Mr. NeddySeagoon,

HELP!!!

Can you check again my network? My network setup figure available at:-

http://www.geocities.com/fy_heng/Network.JPG [Please ZooM for clearer image]

Setup:

 *Quote:*   

>   winbox                   ath0             eth0               
> 
> 192.168.20.3)))   (((AP) 192.168.20.2 | 192.168.10.2-------ISP

 

Overall I am building an simple access point. 

1. IP Forwarding part:

 *Quote:*   

> echo 1 > /proc/sys/net/ipv4/ip_forward

 

 *Quote:*   

> cd /etc/sysctl.conf
> 
> net.ipv4.conf.forwarding=1

 

2. Routing Table in Linux based Box:

 *Quote:*   

> root@heng:/home/heng# route -n 
> 
> Kernel IP routing table 
> 
> Destination     Gateway         Genmask              Flags Metric Ref    Use    Iface 
> ...

 

3. Windows based Desktop side:

From the figures, the Windows based Desktop is connected to the access point (AP) through static configuration at IP = 192.168.20.3 / 24, GW = 192.168.20.2. It not able to surf net. From Windows prompt, it able to ping all the interfaces at the Linux based Box, it able to ping 192.168.20.3 (itself), 192.168.20.2 and 192.168.10.2. It mean there are a connectivity at a whole. But my problem now, is on the Linux based Box, see below:-

4. Linux based Box side:

From the figures, the laptop have 2 interfaces. One is ath0 that configured as an access point and eth0 is a Ethernet that connect to my home ADSL. It able to surf net. From the laptop itself, I able to ping 192.168.10.2 and 192.168.20.2. But, I not able to ping 192.168.20.3 (the client Windows based desktop). Why I able to ping from Windows side, and not able to ping from the Linux side to the client interface?

 *Quote:*   

> root@heng:/home/heng# ping 192.168.10.2
> 
> PING 192.168.10.2 (192.168.10.2) 56(84) bytes of data. 
> 
> 64 bytes from 192.168.10.2: icmp_seq=1 ttl=64 time=0.083 ms 
> ...

 

r *Quote:*   

> oot@heng:/home/heng# ping 192.168.20.2
> 
> PING 192.168.20.2 (192.168.20.2) 56(84) bytes of data. 
> 
> 64 bytes from 192.168.20.2: icmp_seq=1 ttl=64 time=0.080 ms 
> ...

 

 *Quote:*   

> root@heng:/home/heng# ping 192.168.20.3
> 
> PING 192.168.20.3 (192.168.20.3) 56(84) bytes of data. 
> 
> From 192.168.20.2 icmp_seq=2 Destination Host Unreachable 
> ...

 

It give Destination Host Unreachable.

Anything wrong on the interface IP configuration or routing table? or I must use the Linux for Desktop other than Windows based? Do I need to perform the IP Masquerade? I just want to ping from the Linux side to the 192.168.20.3

Someone please assist.Last edited by Paris Heng on Sun Aug 19, 2007 8:48 pm; edited 3 times in total

----------

## NeddySeagoon

tipp98,

The linux box is looking good. On the windows box run, run netstat.

To do that, Press start, and select run. type the program name cmd.exe (it may be command.exe) to get a DOS box.

Type netstat in the DOS box.

You may need to use netstat /h to discover its options.  What we need is the routing table from the Windows box

This is all from memory, since I don't have windows

----------

## NeddySeagoon

Paris Heng,

If any windows firewall is on, please turn it off.  Many of them drop ping requests

----------

## tipp98

netstat -r

```
===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x60002 ...00 16 76 c9 2b 65 ...... Intel(R) 82566DC Gigabit Network Connection - Packet Scheduler Miniport

===========================================================================

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0     192.168.1.10    192.168.1.44     10

        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1     1

      192.168.1.0    255.255.255.0     192.168.1.44    192.168.1.44     10

     192.168.1.44  255.255.255.255        127.0.0.1       127.0.0.1     10

    192.168.1.255  255.255.255.255     192.168.1.44    192.168.1.44     10

        224.0.0.0        240.0.0.0     192.168.1.44    192.168.1.44     10

  255.255.255.255  255.255.255.255     192.168.1.44    192.168.1.44     1

Default Gateway:      192.168.1.10

===========================================================================

Persistent Routes:

  None

Route Table

```

----------

## NeddySeagoon

tipp98,

Thanks for the command and illustration of the output.

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> Paris Heng,
> 
> If any windows firewall is on, please turn it off.  Many of them drop ping requests

 

Yes, of course i turn-off the Firewall.

----------

## NeddySeagoon

Paris Heng,

What about your netstat -r from the Windows box ?

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> Paris Heng,
> 
> What about your netstat -r from the Windows box ?

 

It show you later, i in campus mow. THanx alot.

----------

## Paris Heng

Dear NeddySeagoon,

I able to ping from both side successfully! 

But the Windows Box (192.168.20.3) still not able to use the Internet connection which provide by the ADSL. How ya? To enable NAT/IP Masqurade? 

Here is the Routing table (192.168.20.3) on the Windows that I promise to show you, together with the network setup:-

http://www.geocities.com/fy_heng/Network.JPG

But in the Windows Routing table, it don't have the entry of 192.168.10.0.

----------

## NeddySeagoon

Paris Heng,

You need to add a static route to the Windows box to tell it how to reach the 192.168.10.0/24 network.

I recall that windows has a route command similar to linux (in the DOS box)

You may also be able to add it using the network applet in control panel. I can't confirm either of those, since I don't have windows.

----------

## Paris Heng

 *NeddySeagoon wrote:*   

> Paris Heng,
> 
> You need to add a static route to the Windows box to tell it how to reach the 192.168.10.0/24 network.
> 
> I recall that windows has a route command similar to linux (in the DOS box)
> ...

 

Yes. Windows have. Later i will try it. 

Which one i need to add? It is 192.168.10.0 (eth0 network) or 192.168.10.2 (eth0 address) or 192.168.10.1 (eth0 gateway) ? Do i need to add the route to the ADSL?

If after i adding the route at Windows, can i connect to the Internet already?

Do I need?

Routing protocol, sort of RIP/OSPF ? 

IP Masquerade ? 

NAT ?

Proxy ARP or ARP ?

I just want to connect to Internet, thanx~~ ^_^

----------

## NeddySeagoon

Paris Heng,

I think you only need the static route on the windows system that tells it how to reach the wired network.

If thats not enough, it time to emerge tcpdump and watch for traffic to and from the Windows box on both the laptops interfaces.

I can't say how to set up a static route in windows as I don't know how.

----------

## Paris Heng

Hi, i finally can use the Internet at the client side which connected to AP.

But i can only use IP address of the website to login, e.g. for http://www.bbc.co.uk, i can only use http://212.58.240.110/ to login.

What was i need to do next? DNS inn Linux Box?

thanx

----------

## Paris Heng

Dear NeddySeagoon,

Case 1: Before this i try the setup in ADSL environment, and it success. The client able to use the Internet access. IPtables postrouting to ppp0.

Case 2: When i switch to LAN router, it fail. The client unable to use the Internet access. Then, for the second case, what should the IPtables postrouting to? To which interace? br0 or eth0?

See the internal network interface setup:-

http://www.geocities.com/fy_heng/AP

Please assist.

----------

## NeddySeagoon

Paris Heng,

It looks like you need to manually tell the Windows system what IP address to use for its DNS server.

Set it to the DNS IP address you can get from your ISPs website, since that will work while you are online.

Using the IP address from the  nameserver <IP> line in the Linux /etc/resolv.conf will also work, unless thats the IP you are allocated to the far end of your PPPoE link, in which case it may change from session to session, which would break DNS on the Windows system.

Your routing and forwarding is clearly correct now, and they are usually the hard bits

----------

## Paris Heng

IC i get what you mean. For case 2. The iptables, which interface i should postrouting to? The br0 or the eth0 ?

----------

## NeddySeagoon

Paris Heng,

I don't do IPTables ... I have a seperate Linux box with a firewall distro on it.

There are only two options ... a little trial and error should give the right answer, if there is one.

----------

