# how to: Multiple lan routes?

## kaltag

Good morning. I have a gentoo box with 4 nics. I have one connected via crossover to a workstation (eth3 192.168.4.1), 1 going into a wireless router (eth0 192.168.3.1), and each of the other 2 go to to seperate lans (eth1=192.168.2.120 and eth2=192.168.1.124). I want the workstation and wireless router to be able to see machines on all the networks and access internet connections available on both lans. The gentoo box can ping hosts on both lans and internet hosts. The workstation can't ping anything but the gentoo box. Here's my routing table:

```

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 eth3

192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth2

127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 eth1

0.0.0.0         192.168.1.1     0.0.0.0         UG    1      0        0 eth2

```

I'm not very good at this routing stuff  :Sad:  any help is appreciated and yes, I do have ip forward enabled.

----------

## NeddySeagoon

kaltag,

You can either set up your box with the 4 NICs as a router or you can add static routes to all the other systems so they know how to reach the other networks

Setting up the system as a router is a one time thing and works dynamically as you add systems to your network(s).

Static routing has to be set up on every machine as you add them.

The router method is described in The Home Router Guide you will need to extend it for more interfaces than it describes but thats easy.

Static routing is described in /etc/conf.d/net.example if you have baselayout1 or /usr/share/doc/openrc/net.example if you have baselayout2

----------

## kaltag

Thank you for the quick reply. I would like to use the router method since there is already a sizeable network in place and I don't want to be changing everyone's routing tables  :Very Happy: . I think the correct modification for the firewall would be this? 

```

iptables -F; iptables -t nat -F; iptables -t mangle -F

iptables -t nat -A POSTROUTING -o eth2,eth1 -j MASQUERADE

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state NEW -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -P FORWARD ACCEPT

```

eth2 and eth1being the interfaces on the seperate lans. Does this look correct? If it is it's not working. If not I'm not exactly sure what would need to be modified.

----------

## NeddySeagoon

kaltag,

I've been a Smoothwall user longer than I have been a Gentoo user, so I have never needed to manipulate IPTables in the raw.

----------

## kaltag

fair enough  :Smile: . Anyway I've got the router functionality working with just a single lan i.e the 192.168.4.x workstation can access the 192.168.1.x network with a single masquerade and second lan interface down. As soon as I bring the second lan interface up the 192.168.4.x network loses internet but can still access the 192.168.1.x network which is strange since it has an internet connection.

----------

## infinite1der

 *kaltag wrote:*   

> Good morning. I have a gentoo box with 4 nics. I have one connected via crossover to a workstation (eth3 192.168.4.1), 1 going into a wireless router (eth0 192.168.3.1), and each of the other 2 go to to seperate lans (eth1=192.168.2.120 and eth2=192.168.1.124). I want the workstation and wireless router to be able to see machines on all the networks and access internet connections available on both lans. The gentoo box can ping hosts on both lans and internet hosts. The workstation can't ping anything but the gentoo box. Here's my routing table:
> 
> ```
> 
> Kernel IP routing table
> ...

 

Uh... simply `sysctl -w net.ipv4.conf.all.forwarding=1` and change your netmask to 255.255.0.0. Voila. Everyone can see everyone. No static routes and no iptables mess.

--JamesT

----------

## kaltag

ok, so change the netmask on the linux box's ips or the clients? I changed all the gentoo box's interface netmasks to 192.168.0.0 and it broke everything. Not network ot internet for any machine.

----------

## infinite1der

You say you have two separate LANs on eth1 and eth2 but only list a single IP. Is there an actual network behind there (with a separate switch/hub)?

Based on your current config, you'd need to re-IP everything with the same netmask:

>>>Wireless Router (192.168.3.0/255.255.0.0)

|   >>Lan1 (192.168.2.0/255.255.0.0)

|   |

A   B

Gentoo Box

C   D

|   |

|   >>Xover>>Workstation(192.168.4.0/255.255.0.0)

>>>Lan2 (192.168.1.0/255.255.0.0)

so...

eth0: 192.168.3.1 netmask 255.255.0.0

eth1: 192.168.2.120 netmask 255.255.0.0

eth2: 192.168.1.124 netmask 255.255.0.0

eth3: 192.168.4.1 netmask 255.255.0.0

I can only ASSume that your wireless router is where your default gateway should be. So, you'd need to set the default gateway on every device to whatever that IP is (e.g. route add default gw 192.168.4.254).

This is all ASSuming you are wanting each "network" to be able to talk to one another (i.e. making your Gentoo box a "router" and NOT a firewall).

----------

## NeddySeagoon

kaltag,

You have to change your netmask everywhere. By changing to 255.255.0.0 your are reducing your system to a single logical network. Thats not a good idea from the security point of view.

----------

