Cannot properly configure a gateway on Ubuntu 16.04

Question

I'm trying to make a gateway using Ubuntu 16.04, my server has the following nics:

enp4s0    Link encap:Ethernet  HWaddr 00:15:c5:f6:c0:36
          inet addr:192.168.0.101  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::215:c5ff:fef6:c036/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5118 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3065 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:7474529 (7.4 MB)  TX bytes:254689 (254.6 KB)
          Interrupt:16

enp6s0    Link encap:Ethernet  HWaddr 00:08:54:31:8f:79
          inet addr:172.24.3.19  Bcast:172.24.3.255  Mask:255.255.252.0
          inet6 addr: fe80::208:54ff:fe31:8f79/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7573 errors:0 dropped:334 overruns:0 frame:0
          TX packets:2756 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:756664 (756.6 KB)  TX bytes:881724 (881.7 KB)

enp4s0 is WAN nic, connected to Internet. enp6s0 is LAN nic.

I configured them as it is on /etc/network/interfaces:

allow-hotplug enp4s0
iface enp4s0 inet dhcp

allow-hotplug enp6s0
iface enp6s0 inet static
address 172.24.3.19
netmask 255.255.252.0
gateway 172.24.0.1
dns-nameservers 172.24.3.1

enp4s0 received ip as follows, extracted from /var/lib/dhcp/dhclient.enp4s0.leases:

lease {
  interface "enp4s0";
  fixed-address 192.168.0.101;
  option subnet-mask 255.255.255.0;
  option routers 192.168.0.1;
  option dhcp-lease-time 7200;
  option dhcp-message-type 5;
  option domain-name-servers 192.168.0.1,8.8.8.8;
  option dhcp-server-identifier 192.168.0.1;
  renew 5 2018/06/08 16:03:17;
  rebind 5 2018/06/08 16:59:19;
  expire 5 2018/06/08 17:14:19;
}

Following Nairabytes.net, I applied some iptables rules as followed:

iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
iptables -A FORWARD -i enp4s0 -o enp6s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i enp6s0 -o enp4s0 -j ACCEPT

So iptables rules became as followed:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But what I cannot understand is why just one of two nics works properly. While this server can talk to LAN by enp6s0, it cannot connect to internet.

So I apply this route to it:

sudo /sbin/route add -net 0.0.0.0 gw 192.168.0.1 enp4s0

And the thing goes reverted! Now the server can connect to internet, but becomes unaccessible to LAN.

What am I doing wrong?

Answer 1

sudo /sbin/route add -net 0.0.0.0 gw 192.168.0.1 enp4s0

This sets a route for everything to 192.168.0.1.

You probably want to add default gateway, which means anything not matching any more specific routes goes here. This can be done with the following command:

sudo ip route add default via 192.168.0.1 dev enp4s0

In addition, you will need a route for 172.24.0.0/16 on the other NIC:

sudo ip route add -net 172.24.0.0/16 via 172.24.3.1 dev enp6s0

This will add a route to your local 172.240.0/16-network, enabling you to reach this network. As this is a more specific route, it is picked over default for packets going to 172.24.0.0.