How to enable forwarding of data between two local interfaces?

Question

I have installed Ubuntu 11.10 on a refurbished machine. I have also replaced a defective NIC card with a new NIC card, two NIC cards are recognized when the install occurs. I also have squid installed as a proxy server. Squid works well when all workstations are connected to the router. However ... .

When I connect one NIC to my router (live internet connection available), the other NIC to my switch (without any internet available), I can create two separate networks, but I can't figure out how to make the two NIC cards transfer data between themselves, as well as, across the two networks.

1. I have tried to bridge both Ethernet cards ... no luck!
2. I have tried to update iptables ... no luck!
3. I have set both NIC cards to static addresses ... no luck!
4. I have configured one NIC to use the other as a gateway ... no luck! All result in an error that the pinged address (network related to switch) is on an unreachable destination.

What am I missing?

Answer 1

The script described by @laurent is unnecessary, because there is a canonical way. All you need to do is edit /etc/sysctl.conf and uncomment (delete # at the beginning of) this line:

net.ipv4.ip_forward = 1

Then it will already be applied at boot.

Answer 2

Ubuntu has ip fowarding disabled by default and you need to enable it to route packets with your machine:

to enable, type in terminal as root (sudo su):

echo 1 > /proc/sys/net/ipv4/ip_forward

Obs: doesn't work with sudo

And if you want to route internet from this machine you may need to configure NAT also.

EDIT:

the 1st command echo 1 ... doesn't work with sudo. You have to change to root with sudo su before (because sudo will run echo 1 as root but will try to redirect to the file as your user and this won't work). Anyways, you allways can check if there is a 1 with cat /proc/sys/net/ipv4/ip_forward. Obs: this has to be done on every boot so you can write a script and use update-rc.d on it.

POSTROUTING rule looks OK if eth0 is your internet connection NIC.

FORWARD rules I use for established and related connections:

-A FORWARD -p tcp -m state -d your_network_ip.0/255.255.255.0 --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p udp -m state -d your_network_ip.0/255.255.255.0 --state RELATED,ESTABLISHED -j ACCEPT

---

2nd UPDATE - Automatic script:

#!/bin/sh
# turn ip_forward on/off

case "$1" in
'start')
        echo 1 > /proc/sys/net/ipv4/ip_forward
        ;;
'stop')
        echo 0 > /proc/sys/net/ipv4/ip_forward
        ;;
*)
        echo "Usage: $0 { start | stop }"
        ;;
esac
exit 0

You save this script in /etc/init.d with the name you want (router for example) and you make it executable (sudo chmod +x /etc/init.d/router).

To have it run on each reboot you need to make start links with update-rc.d:

sudo update-rc.d router defaults

Other things you have to check:

• DHCP working on the 2nd network and sending your machine IP as default gateway to subnet
• default gateway (your machine IP in the new subnet) is better with fixed IP
• you commented you can't ping the 2nd NIC but from where? the subnet, your machine or machines connected directly on the router?
• squid is installed on your machine? Did you change the config to include the new subnet? Do you need squid? It is not very easy to configure and you can very well share internet and network without it if you don't need its additional features.

Obs: the update-rc.d message is OK, no problem with it. You should now have always a 1 in ip_forward file.

Answer 3

I tried this advice and ran into a problem that isn't covered here: the next computer has to know how to get back to the last computer.

In my case, I have 2 networks: A WiFi network, 192.168.1.0/24, and an Ethernet network, 192.168.40.0/24. My "router" is a laptop with both a WiFi transceiver on the 192.168.1.0/24 and an Ethernet interface on the 192.168.40.0/24 network. The household router also has a WiFi transceiver and an Ethernet interface, but this Ethernet transceiver connects to The Internet. The household router also has a Network Address Translator (NAT). The household router has a routing table, and that routing table has a default route entry, which normally points to the Internet Service Providers (ISP's) router.

When a computer on the 192.168.40.0/24 network wished to send a packet to some computer on The Internet, it consulted its own routing table and knew that the default gateway was the laptop, 192.168.40.1. When the packet arrived at the laptop, it consulted its own routing table and forwarded the packet to the household router. The household router consulted its routing table, went through Network Address Translation (a detail we can ignore for this discussion), and then to the ISP's router. At some point, the destination machine will want to send a packet to my computer. The packet will arrive at the household router, go through reverse NAT, and then have to be routed. When the packet comes out of NAT, it will have a destination IPv4 address in the 192.168.40.0/24 network. It was at this point that I ran into a problem: the household router didn't know about the Ethernet network, 192.168.40.0/24. So it did what it's supposed to do - forward that packet to its default router, i.e. the ISP's router.

To resolve the problem, I had to make an entry in the household router's routing table, which tells it that to get to any computer in the 192.168.40.0/24 network, send the packet to the laptop's WiFi address, which is in 192.168.1.0/24. Now, when the packet arrives at the laptop, the laptop knows about the 192.168.40.0/24 network, and routes the packet there.