routing between subnets

I have NAT router (R.H7.3) with 2 subnets (eth1 and eth2), eth0 go to
internet.
From both subnet can go to internet.
But I want go from one subnet to second.
How can tat do? IPTABLES default policys are all ACCEPT and NAT work
well.


| internet
| eth0
|
|
|
-----------
| Router |
| |
-----------
| |
| |
| eth2
| 192.168.11.1/24
eth1
192.168.10.1/24

> But I want go from one subnet to second.
> How can tat do? IPTABLES default policys are all ACCEPT and NAT work
> well.
>
>
> | internet
> | eth0
> |
> |
> |
> -----------
> | Router |
> | |
> -----------
> | |
> | |
> | eth2
> | 192.168.11.1/24
> eth1
> 192.168.10.1/24
I think you won't need NAT for traffic between the two local subnets.
First you have to configure the router, to forward the Packages, what
you did. Now you only need to have working routes both at the clients
and the router. Looks like this:
Client:
route add -net 192.168.11.0/24 gw router
at the first subnet
route add -net 192.168.10.0/24 gw router
at the second
Router:
route add -net 192.168.10.0/24 dev eth1
route add -net 192.168.11.0/24 dev eth2
That should do.

bye
Peter

On Thu, 31 Jul 2003 14:56:53 +0300, Indrek M. <(E-Mail Removed)> wrote:
> I have NAT router (R.H7.3) with 2 subnets (eth1 and eth2), eth0 go to
> internet.
> From both subnet can go to internet.
> But I want go from one subnet to second.
> How can tat do? IPTABLES default policys are all ACCEPT and NAT work
> well.
>
>
> | internet
> | eth0
> |
> |
> |
> -----------
> | Router |
> | |
> -----------
> | |
> | |
> | eth2
> | 192.168.11.1/24
> eth1
> 192.168.10.1/24

You need to insert rules at the head of your iptables FORWARD chain that
forwards between these interfaces, before it hits any masq rules. Not
sure if exact syntax is correct since this is based on an old ipchains
example I had, but something like this:

iptables -I FORWARD -p all -s -i eth1 -d -i eth2 -j ACCEPT
iptables -I FORWARD -p all -s -i eth2 -d -i eth1 -j ACCEPT

Or maybe this could be condensed to:

iptables -I FORWARD -p all -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT

--
David Efflandt - All spam ignored http://www.de-srv.com/
http://www.autox.chicago.il.us/ http://www.berniesfloral.net/
http://cgi-help.virtualave.net/ http://hammer.prohosting.com/~cgi-wiz/