centos7 as gateway doesnt work

Issues related to configuring your network
Post Reply
logg sar
Posts: 15
Joined: 2016/05/04 14:26:41

centos7 as gateway doesnt work

Post by logg sar » 2020/10/22 15:02:59

Hi there

I'm stucked in a problem regarding network connection.
In my environment is an ESX-Server. On this server is a VM with Centos7 and two network cards. Over a sophos I have internet connection.

Like this

Code: Select all

centos7                                                centos7 (router)                                   sophos
------------                                        --------------                                     ------------
|           |                                      | webserver  |                                         |       |
|           |                                      | dns-server |                                         |       |
|client     | -192.168.2.118 --------- 192.168.2.1-| dhcp-server| -192.168.100.20 ------- 192.168.100.254-| sophos|-internet
|           |  (dhcp)                      fixed   | nfs-server |   fixed                           fixed |       |
|           |                                      | squid-proxy|                                         |       |
------------                                       --------------                                         ---------
[/tt]

From the Centos in the middle (my designated router device) everything works. DNS-resolution, Ping and so on.

If a client boots up it gets an IP but no Internet connection.
Pinging of both IPs of the router (192.168.2.1 and 192.168.100.20) is working, but no Ping to 192.168.100.254

So I've enabled the routing (echo 1 > /proc/sys/net/ipv4/ip_forward)
The IP-Config on the Router looks like this:

Code: Select all

ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:81:36:00 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.20/24 brd 192.168.100.255 scope global noprefixroute ens224
       valid_lft forever preferred_lft forever
    inet6 fe80::4da:10e4:b9be:62d/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: ens256: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:81:39:24 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.1/24 brd 192.168.2.255 scope global noprefixroute ens256
       valid_lft forever preferred_lft forever
    inet6 fe80::1ebc:9433:589a:7b20/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

Code: Select all

ip r
default via 192.168.100.254 dev ens224 proto static metric 100 
192.168.2.0/24 dev ens256 proto kernel scope link src 192.168.2.1 metric 101 
192.168.100.0/24 dev ens224 proto kernel scope link src 192.168.100.20 metric 100

Code: Select all

cat /etc/sysconfig/network
# Created by anaconda
GATEWAY=192.168.100.254
NETWORKING=yes
On the client (left)

Code: Select all

ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 4c:52:62:0c:74:bc brd ff:ff:ff:ff:ff:ff
3: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 90:1b:0e:ea:07:0e brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.118/24 brd 192.168.2.255 scope global dynamic noprefixroute enp2s0
       valid_lft 86343sec preferred_lft 86343sec
    inet6 fe80::af99:1bb3:f89b:d45a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
4: wlp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether f8:94:c2:a6:b4:f4 brd ff:ff:ff:ff:ff:ff

Code: Select all

ip r
default via 192.168.2.1 dev enp2s0 proto dhcp metric 20100 
169.254.0.0/16 dev enp2s0 scope link metric 1000 
192.168.2.0/24 dev enp2s0 proto kernel scope link src 192.168.2.118 metric 100

Code: Select all

dig redhat.com

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> redhat.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26486
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;redhat.com.			IN	A

;; ANSWER SECTION:
redhat.com.		3080	IN	A	209.132.183.105

;; Query time: 18 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Thu Oct 22 16:55:00 CEST 2020
;; MSG SIZE  rcvd: 55

Code: Select all


 tracepath redhat.com
 1?: [LOCALHOST]                      pmtu 1500
 1:  _gateway                                              0.299ms 
 1:  _gateway                                              0.229ms 
 2:  no reply
 3:  no reply
 4:  no reply
 5:  no reply
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
18:  no reply
19:  no reply
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
25:  no reply
26:  no reply
27:  no reply
28:  no reply
29:  no reply
30:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500

Code: Select all

 ping -c 4 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.230 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=0.291 ms
64 bytes from 192.168.2.1: icmp_seq=3 ttl=64 time=0.308 ms
64 bytes from 192.168.2.1: icmp_seq=4 ttl=64 time=0.290 ms

--- 192.168.2.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3051ms
rtt min/avg/max/mdev = 0.230/0.279/0.308/0.036 ms

Code: Select all

 ping -c 4 192.168.100.20
PING 192.168.100.20 (192.168.100.20) 56(84) bytes of data.
64 bytes from 192.168.100.20: icmp_seq=1 ttl=64 time=0.262 ms
64 bytes from 192.168.100.20: icmp_seq=2 ttl=64 time=0.257 ms
64 bytes from 192.168.100.20: icmp_seq=3 ttl=64 time=0.294 ms
64 bytes from 192.168.100.20: icmp_seq=4 ttl=64 time=0.291 ms

--- 192.168.100.20 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3058ms
rtt min/avg/max/mdev = 0.257/0.276/0.294/0.016 ms
As I said before - I'm stucked.
The IP-config seems to be correct. The Routing table also. I would say on both devices.
I enabled the routing (Firewall is disabled. Permanently)

Where I'm missing something?
Top
vinicio.zanchettin
Posts: 3
Joined: 2020/11/20 11:29:51

Re: centos7 as gateway doesnt work

Post by vinicio.zanchettin » 2020/11/20 12:02:16

Hello, there are two configuration to the simple forward:

# Enabling forward module in the kernel
net.ipv4.ip_forward = 1 (justo to test, no permanent)

or

sysctl -w net.ipv4.ip_forward=1 (permanent configuration)
sysctl -p /etc/sysctl.conf

# Masquerade to the output, change eth0 for your wan interface.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Top
User avatar
TrevorH
Site Admin
Posts: 33216
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: centos7 as gateway doesnt work

Post by TrevorH » 2020/11/20 16:19:35

sysctl -w net.ipv4.ip_forward=1 (permanent configuration)
That's not a permanent solution. It's one boot only. To make it persistent you need to add that to /etc/sysctl.d/$some.conf or to /etc/sysctl.conf.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Top
BShT
Posts: 585
Joined: 2019/10/09 12:31:40

Re: centos7 as gateway doesnt work

Post by BShT » 2020/11/20 19:10:44

iptables -t nat -A POSTROUTING -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --policy FORWARD ACCEPT

#you can set a more restrictive conf at FORWARD
Top
Post Reply

Return to “CentOS 7 - Networking Support”