# No access to internet after changing from Gateway to Router

## iefoaix

No access to internet after changing from Gateway to Router mode

Here is my setup:

```

                WAN 

                 | 

        -------------------------------

        | 74.96.170.x (WAN IP)         | 

        | Router1(Verizon FiOS Router) | 

        | Model: MI424WR-GEN2 (Rev F)  | 

        | Firmware: 20.21.0.2          |

        | Def router: 74.96.170.1      |

        | 192.168.1.1 (Local IP)       | 

        -------------------------------

                 ||                  ---------------------------

                 ||                  |  192.168.1.22 (WAN IP)   | 

                  ===================|  Router2(Linksys)        | 

                                     |  Model: WRT54GL v1.1     |

                                     |  Firmware: v4.30.16      |

                                     |  Def Router: 192.168.1.1 |

                                     |  192.168.2.1 (Local IP)  |

                                     ---------------------------

                                               ||

                                               ||

                                     ---------------------------- 

                                     | Computer 192.168.2.160   | 

                                     | Def Router: 192.168.2.1  | 

                                     | NO iptables, basic setup |

                                     ----------------------------

```

On computer, I have:

```

# route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         192.168.2.1     0.0.0.0         UG    2      0        0 enp2s0

loopback        localhost       255.0.0.0       UG    0      0        0 lo

192.168.2.0     *               255.255.255.0   U     0      0        0 enp2s0

```

On Router2, I have:

```

Routing Table Entry List

Destination LAN IP | Subnet Mask   | Gateway   | Hop Count | Interface

192.168.2.0          255.255.255.0   0.0.0.0     1           LAN & Wireless

192.168.1.0          255.255.255.0   0.0.0.0     1           WAN (Internet)

0.0.0.0              0.0.0.0         192.168.1.1 1           WAN (Internet)

```

Router2's Operating Mode is Gateway. On Router1, I have: 

```

[Router1] Routing Table

Name                  Destination Gateway      Netmask       Metric   Status

Network (Home/Office) 192.168.2.0 192.168.1.22 255.255.255.0 0        Applied 

Network (Home/Office) 192.168.1.0 192.168.1.1  255.255.255.0 0        Applied 

Routing Protocol: Internet Group Management Protocol (IGMP)

Default Gateway: 74.96.170.1

```

On computer, I can run tcptraceroute to yahoo.com OK:

```

# tcptraceroute yahoo.com

Selected device enp2s0, address 192.168.2.160, port 46596 for outgoing packets

Tracing the path to yahoo.com (206.190.36.45) on TCP port 80 (http), 30 hops max

 1  192.168.2.1  0.610 ms  0.729 ms  0.735 ms

 2  192.168.1.1  1.843 ms  1.378 ms  1.363 ms

 3  l100.washdc-vfttp-107.verizon-gni.net (96.241.146.1)  13.620 ms * *

... /* It reached the destination. */

```

I want to change Router2's Operating Mode from "Gateway" to "Router" because I

want to turn off NAT on Router2 so that I can access all computers attached to

Router2 by their individual IP instead of using port forwarding at Router2.

The problem is after the mode change from "Gateway" to "Router", and regardless

whether I disable RIP or enable RIP, and on what interfaces it is enabled, computer

192.168.2.160 does not have internet connection. 

Observations:

[0]INTRAnet works as I can reach computer 192.168.2.160 from computer behind Router1 192.168.1.x and vice versa.

[1] ping and traceroute *work* on Router2 itself using the built-in dianostic tool.

[2] nslookup on computer 192.168.2.160 always works on new lookup. It uses

192.168.2.1 as the resolver.

[3] tcptraceroute stops after step 2:

```

# tcptraceroute yahoo.com

Selected device enp2s0, address 192.168.2.160, port 45999 for outgoing packets

Tracing the path to yahoo.com (98.139.183.24) on TCP port 80 (http), 30 hops max

 1  192.168.2.1  2.553 ms  0.534 ms  0.638 ms

 2  192.168.1.1  1.342 ms  0.964 ms  0.867 ms

 3  * * *

```

[4] tcpdump shows that computer 192.168.2.160 tries to reach out and nothing is returned:

```

13:34:03.172828 IP 192.168.2.160.45999 > 98.139.183.24.http: Flags [S], seq 1122548929, win 0, length 0

13:34:06.175786 IP 192.168.2.160.45999 > 98.139.183.24.http: Flags [S], seq 1122548929, win 0, length 0

13:34:09.178804 IP 192.168.2.160.45999 > 98.139.183.24.http: Flags [S], seq 1122548929, win 0, length 0

```

This is not expected because NAT to internet should still be done by Router1, no? Computer

behind Router1 with IP 192.168.1.x has internet connection.

[5] It looks like I cannot change the Routing Table Entry on Router2. I do not think I need to change anything, just an observation.

----------

## Ant P.

192.168.1.1 needs a route to 192.168.2.0/24 via 192.168.1.22 in order for traffic to work both ways.

----------

## iefoaix

Ant P. said: "192.168.1.1 needs a route to 192.168.2.0/24 via 192.168.1.22 in order for traffic to work both ways."

This is very true. In original post I have:

"Network (Home/Office) 192.168.2.0 192.168.1.22 255.255.255.0 0        Applied"

without this, the intranet between 192.168.1.x and 192.168.2.x won't work. The problem is that intranet works, but the 192.168.2.x cannot reach internet.

----------

## Ant P.

Sorry you're right, I misread. The routes all look correct.

What does router2 show for these?

```
sysctl net.ipv4.{ip_forward,conf.{default,all}.forwarding}
```

Do you have any routing software like quagga or is this all manual?

----------

## iefoaix

 *Ant P. wrote:*   

> Sorry you're right, I misread. The routes all look correct.
> 
> What does router2 show for these?
> 
> ```
> ...

 

Hello Ant -

Router2 is Linksys router running the default Linksys software that I access via the web interface. I do not think I can run the command you provided. The following is run on the computer 192.168.2.160 behind the Router2:

```

# sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 0

# sysctl net.ipv4.conf.default.forwarding

net.ipv4.conf.default.forwarding = 0

# sysctl net.ipv4.conf.all.forwarding

net.ipv4.conf.all.forwarding = 0

```

I can run traceroute from Router2 diagnostic interface, and that is working. The computer behind Router2 (192.168.2.160) can ssh to computer behind Router1 (192.168.1.x), but not to the internet. Traceroute shows it goes through 192.168.2.1 and then 192.168.1.1 and it stops there:

```

# tcptraceroute yahoo.com

Selected device enp2s0, address 192.168.2.160, port 48298 for outgoing packets

Tracing the path to yahoo.com (98.138.253.109) on TCP port 80 (http), 30 hops max

 1  192.168.2.1  2.922 ms  0.602 ms  0.589 ms

 2  192.168.1.1  1.350 ms  0.901 ms  0.881 ms

 3  * * *

```

tcpdump shows it sends out packets to the internet, but not receiving packets from the internet. It makes me think that somehow, somewhere it prevents the packets routing back to 192.168.2.160, the computer behind Router2.

I have marked Router2 (192.168.1.22) as DMZ host on Router1, but that does not help.

----------

## Jaglover

You need to put the Router2 into bridge mode. Or put Router1 into bridge mode and do NAT in your WRT.

----------

## iefoaix

 *Jaglover wrote:*   

> You need to put the Router2 into bridge mode. Or put Router1 into bridge mode and do NAT in your WRT.

 

Yes, that works, but why do I have to use one of the routers in bridge mode? Why cannot I have this?

```

(internet IP) Router 1 (192.168.1.1) <-> (192.168.1.22) Router 2 (192.168.2.1) <-> (192.168.2.160) Computer2

                       |

            (192.168.1.160) Computer1

```

The two computers can talk to each other, the problem is Computer2 cannot talk to internet while Computer1 can.

----------

## iefoaix

 *Ant P. wrote:*   

> Sorry you're right, I misread. The routes all look correct.
> 
> What does router2 show for these?
> 
> ```
> ...

 

Ant: I have another Linksys router WRT54G v3.1 that I run OpenWRT (White Russia), and it has exact the same issue: if I run with NAT enable (by default), access to internet works; if I have NAT disabled (iptables -t nat -F), then access to internet does not work.

I do have these settings:

```

+ sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

+ sysctl net.ipv4.conf.default.forwarding

net.ipv4.conf.default.forwarding = 1

+ sysctl net.ipv4.conf.all.forwarding

net.ipv4.conf.all.forwarding = 1

```

----------

