introduction to routers

(Written by Paul Cobbaut, https://github.com/paulcobbaut/)

What follows is a very brief introduction to using Linux as a router.

router or firewall

A router is a device that connects two networks. A firewall is a device that besides acting as a router, also contains (and implements) rules to determine whether packets are allowed to travel from one network to another. A firewall can be configured to block access based on networks, hosts, protocols and ports. Firewalls can also change the contents of packets while forwarding them.

packet forwarding

Packet forwarding means allowing packets to go from one network to another. When a multihomed host is connected to two different networks, and it allows packets to travel from one network to another through its two network interfaces, it is said to have enabled packet forwarding.

packet filtering

Packet filtering is very similar to packet forwarding, but every packet is individually tested against rules that decide on allowing or dropping the packet. The rules are stored by iptables.

stateful

A stateful firewall is an advancement over stateless firewalls that inspect every individual packet. A stateful firewall will keep a table of active connections, and is knowledgeable enough to recognise when new connections are part of an active session. Linux iptables is a stateful firewall.

nat (network address translation)

A nat device is a router that is also changing the source and/or target ip-address in packets. It is typically used to connect multiple computers in a private address range (rfc 1918) with the (public) internet. A nat can hide private addresses from the internet.

It is important to understand that people and vendors do not always use the right term when referring to a certain type of nat. Be sure you talk about the same thing. We can distuinguish several types of nat.

pat (port address translation)

nat often includes pat. A pat device is a router that is also changing the source and/or target tcp/udp port in packets. pat is Cisco terminology and is used by snat, dnat, masquerading and port forwarding in Linux. RFC 3022 calls it NAPT and defines the nat/pat combo as \"traditional nat\". A device sold to you as a nat-device will probably do nat and pat.

snat (source nat)

A snat device is changing the source ip-address when a packet passes our nat. snat configuration with iptables includes a fixed target source address.

masquerading

Masquerading is a form of snat that will hide the (private) source ip-addresses of your private network using a public ip-address. Masquerading is common on dynamic internet interfaces (broadband modem/routers). Masquerade configuration with iptables uses a dynamic target source address.

dnat (destination nat)

A dnat device is changing the destination ip-address when a packet passes our nat.

port forwarding

When static dnat is set up in a way that allows outside connections to enter our private network, then we call it port forwarding.

/proc/sys/net/ipv4/ip_forward

Whether a host is forwarding packets is defined in /proc/sys/net/ipv4/ip_forward. The following screenshot shows how to enable packet forwarding on Linux.

root@router~# echo 1 > /proc/sys/net/ipv4/ip_forward

The next command shows how to disable packet forwarding.

root@router~# echo 0 > /proc/sys/net/ipv4/ip_forward

Use cat to check if packet forwarding is enabled.

root@router~# cat /proc/sys/net/ipv4/ip_forward

/etc/sysctl.conf

By default, most Linux computers are not configured for automatic packet forwarding. To enable packet forwarding whenever the system starts, change the net.ipv4.ip_forward variable in /etc/sysctl.conf to the value 1.

root@router~# grep ip_forward /etc/sysctl.conf 
net.ipv4.ip_forward = 0

sysctl

For more information, take a look at the man page of sysctl.

root@linux~# man sysctl
root@linux~# sysctl -a 2>/dev/null | grep ip_forward
net.ipv4.ip_forward = 0

practice: packet forwarding

You have the option to select (or create) an internal network when adding a network card in VirtualBox or VMWare. Use this option to create two internal networks. I named them leftnet and rightnet, but you can choose any other name.

Set up two Linux machines, one on leftnet, the other on rightnet. Make sure they both get an ip-address in the correct subnet. These two machines will be 'left' and 'right' from the 'router'.

Set up a third Linux computer with three network cards, one on leftnet, the other on rightnet. This computer will be the 'router'. Complete the table below with the relevant names, ip-addresses and mac-addresses.

    leftnet computer the router                        rightnet
                                                       computer

MAC

IP

: Packet Forwarding Exercise

How can you verify whether the router will allow packet forwarding by default or not ? Test that you can ping from the router to the two other machines, and from those two machines to the router. Use arp -a to make sure you are connected with the correct mac addresses.
Ping from the leftnet computer to the rightnet computer. Enable and/or disable packet forwarding on the router and verify what happens to the ping between the two networks. If you do not succeed in pinging between the two networks (on different subnets), then use a sniffer like wireshark or tcpdump to discover the problem.
Use wireshark or tcpdump -xx to answer the following questions. Does the source MAC change when a packet passes through the filter ? And the destination MAC ? What about source and destination IP-addresses ?
Remember the third network card on the router ? Connect this card to a LAN with internet connection. On many LAN's the command dhclient eth0 just works (replace eth0 with the correct interface).

root@router~# dhclient eth0

You now have a setup similar to this picture. What needs to be done to give internet access to leftnet and rightnet.

solution: packet forwarding

Set up two Linux machines, one on leftnet, the other on rightnet. Make sure they both get an ip-address in the correct subnet. These two machines will be 'left' and 'right' from the 'router'.

The ip configuration on your computers should be similar to the following two screenshots. Both machines must be in a different subnet (here 192.168.60.0/24 and 192.168.70.0/24). I created a little script on both machines to configure the interfaces.

root@left~# cat leftnet.sh
pkill dhclient
ifconfig eth0 192.168.60.8 netmask 255.255.255.0

root@right~# cat rightnet.sh
pkill dhclient
ifconfig eth0 192.168.70.9 netmask 255.255.255.0

Set up a third Linux computer with three network cards, one on leftnet, the other on rightnet. This computer will be the 'router'. Complete the table below with the relevant names, ip-addresses and mac-addresses.

root@router~# cat router.sh ifconfig eth1 192.168.60.1 netmask 255.255.255.0 ifconfig eth2 192.168.70.1 netmask 255.255.255.0

echo 1 > /proc/sys/net/ipv4/ip_forward

Your setup may use different ip and mac addresses than the ones in the table below.

leftnet computer the router rightnet computer

08:00:27:f6:ab:b9 08:00:27:43:1f:5a 08:00:274a:6b 08:00:27:14:8b:17

 192.168.60.8        192.168.60.1        192.168.70.1        192.168.70.9

: Packet Forwarding Solution

How can you verify whether the router will allow packet forwarding by default or not ? Test that you can ping from the router to the two other machines, and from those two machines to the router. Use arp -a to make sure you are connected with the correct mac addresses.

This can be done with \"grep ip_forward /etc/sysctl.conf\" (1 is enabled, 0 is disabled) or with sysctl -a | grep ip_for.

root@router~# grep ip_for /etc/sysctl.conf 
net.ipv4.ip_forward = 0

Ping from the leftnet computer to the rightnet computer. Enable and/or disable packet forwarding on the router and verify what happens to the ping between the two networks. If you do not succeed in pinging between the two networks (on different subnets), then use a sniffer like wireshark or tcpdump to discover the problem.

Did you forget to add a default gateway to the LAN machines ? Use route add default gw 'ip-address'.

root@left~# route add default gw 192.168.60.1

root@right~# route add default gw 192.168.70.1

You should be able to ping when packet forwarding is enabled (and both default gateways are properly configured). The ping will not work when packet forwarding is disabled or when gateways are not configured correctly.

Use wireshark or tcpdump -xx to answer the following questions. Does the source MAC change when a packet passes through the filter ? And the destination MAC ? What about source and destination IP-addresses ?

Both MAC addresses are changed when passing the router. Use tcpdump -xx like this:

root@router~# tcpdump -xx -i eth1

root@router~# tcpdump -xx -i eth2

Remember the third network card on the router ? Connect this card to a LAN with internet connection. On many LAN's the command dhclient eth0 just works (replace eth0 with the correct interface.

root@router~# dhclient eth0

You now have a setup similar to this picture. What needs to be done to give internet access to leftnet and rightnet.

The clients on leftnet and rightnet need a working dns server. We use one of Google's dns servers here.

echo nameserver 8.8.8.8 > /etc/resolv.conf