Ho to route one subnet to another using firewalld CentOS 7

I have a CentOS 7 system, with a VPN host and one physical network interface.

I have my physical network interface assigned to public zone, while my VPN requests are going through trusted. Also, I have some servers, in docker containers routed to the latter zone.

I'd like, if my VPN and Docker containers to have internet connection, while retaining the subnet of 10.8.0.0/24 that I created on zone trusted.

The solution I'm thinking of involves forwarding request from 10.8.0.0/24 to out of the subnet to the physical interface, preferably with masquareding. If you have a better solution, I'm open to it.

So far, my firewalld config looks like this.

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp2s0

  sources:

  services: ssh dhcpv6-client

  ports: 8080/tcp 23/tcp 1194/udp 80/tcp 443/tcp

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:





trusted (active)

  target: ACCEPT

  icmp-block-inversion: no

  interfaces: docker0

  sources: 10.8.0.0/24 2001:0db8:ee00:abcd::/64

  services: openvpn

  ports:

  protocols:

  masquerade: yes

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

I'm kind of confused by the question, because I only have one NIC (physical one at least), which is connected to the internet, via a router. the IP is 192.168.0.241. The VPN has a subnet of 10.8.0.0/24, and the computer in question has the address of 10.8.0.1. I was paying attention, not to have them overlap

– László Stahorszki
Jan 23 at 22:23

1

Okay so try this..... route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 followed by route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 but beforehand you might save the output of the route print somewhere to reference first. To delete those routes you can run route delete 10.8.0.0 and route delete 10.8.0.1.... Think hard about this, have backup of your route table too and be sure you can revert it back out of have a backout method just in case.

– Pimp Juice IT
Jan 23 at 22:26

1

If you add those two routes and there are problems, you can reboot too since they are not persistent so route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 first and then route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 next. If there are issues, reboot and do not run the route delete commands. Still have the route print output of the IPv4 first though.

– Pimp Juice IT
Jan 23 at 22:27

1

There has to be an IP on one subnet that can talk to an IP on another subnet that can then route via Layer 3 routing I think. I've configured static routes like that before on the client machines, and I've configured static routes in routers and firewalls too. There are other ways to do it with other protocols but for things like this, that's how I've handled some in the past. Maybe it will help or maybe not, let me know your thoughts.

– Pimp Juice IT
Jan 23 at 22:31

2

Let us continue this discussion in chat.

– Pimp Juice IT
Jan 23 at 22:46

|
show 2 more comments

I have a CentOS 7 system, with a VPN host and one physical network interface.

I have my physical network interface assigned to public zone, while my VPN requests are going through trusted. Also, I have some servers, in docker containers routed to the latter zone.

I'd like, if my VPN and Docker containers to have internet connection, while retaining the subnet of 10.8.0.0/24 that I created on zone trusted.

So far, my firewalld config looks like this.

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp2s0

  sources:

  services: ssh dhcpv6-client

  ports: 8080/tcp 23/tcp 1194/udp 80/tcp 443/tcp

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:





trusted (active)

  target: ACCEPT

  icmp-block-inversion: no

  interfaces: docker0

  sources: 10.8.0.0/24 2001:0db8:ee00:abcd::/64

  services: openvpn

  ports:

  protocols:

  masquerade: yes

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

I'm kind of confused by the question, because I only have one NIC (physical one at least), which is connected to the internet, via a router. the IP is 192.168.0.241. The VPN has a subnet of 10.8.0.0/24, and the computer in question has the address of 10.8.0.1. I was paying attention, not to have them overlap

– László Stahorszki
Jan 23 at 22:23

1

Okay so try this..... route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 followed by route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 but beforehand you might save the output of the route print somewhere to reference first. To delete those routes you can run route delete 10.8.0.0 and route delete 10.8.0.1.... Think hard about this, have backup of your route table too and be sure you can revert it back out of have a backout method just in case.

– Pimp Juice IT
Jan 23 at 22:26

1

If you add those two routes and there are problems, you can reboot too since they are not persistent so route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 first and then route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 next. If there are issues, reboot and do not run the route delete commands. Still have the route print output of the IPv4 first though.

– Pimp Juice IT
Jan 23 at 22:27

1

There has to be an IP on one subnet that can talk to an IP on another subnet that can then route via Layer 3 routing I think. I've configured static routes like that before on the client machines, and I've configured static routes in routers and firewalls too. There are other ways to do it with other protocols but for things like this, that's how I've handled some in the past. Maybe it will help or maybe not, let me know your thoughts.

– Pimp Juice IT
Jan 23 at 22:31

2

Let us continue this discussion in chat.

– Pimp Juice IT
Jan 23 at 22:46

|
show 2 more comments

I have a CentOS 7 system, with a VPN host and one physical network interface.

I have my physical network interface assigned to public zone, while my VPN requests are going through trusted. Also, I have some servers, in docker containers routed to the latter zone.

I'd like, if my VPN and Docker containers to have internet connection, while retaining the subnet of 10.8.0.0/24 that I created on zone trusted.

So far, my firewalld config looks like this.

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp2s0

  sources:

  services: ssh dhcpv6-client

  ports: 8080/tcp 23/tcp 1194/udp 80/tcp 443/tcp

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:





trusted (active)

  target: ACCEPT

  icmp-block-inversion: no

  interfaces: docker0

  sources: 10.8.0.0/24 2001:0db8:ee00:abcd::/64

  services: openvpn

  ports:

  protocols:

  masquerade: yes

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

I have a CentOS 7 system, with a VPN host and one physical network interface.

I have my physical network interface assigned to public zone, while my VPN requests are going through trusted. Also, I have some servers, in docker containers routed to the latter zone.

I'd like, if my VPN and Docker containers to have internet connection, while retaining the subnet of 10.8.0.0/24 that I created on zone trusted.

So far, my firewalld config looks like this.

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp2s0

  sources:

  services: ssh dhcpv6-client

  ports: 8080/tcp 23/tcp 1194/udp 80/tcp 443/tcp

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:





trusted (active)

  target: ACCEPT

  icmp-block-inversion: no

  interfaces: docker0

  sources: 10.8.0.0/24 2001:0db8:ee00:abcd::/64

  services: openvpn

  ports:

  protocols:

  masquerade: yes

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

networking vpn centos routing firewalld

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

edited Jan 23 at 22:21

asked Jan 23 at 22:01

László Stahorszki

1063

asked Jan 23 at 22:01

László Stahorszki

1063

asked Jan 23 at 22:01

László Stahorszki

1063

I'm kind of confused by the question, because I only have one NIC (physical one at least), which is connected to the internet, via a router. the IP is 192.168.0.241. The VPN has a subnet of 10.8.0.0/24, and the computer in question has the address of 10.8.0.1. I was paying attention, not to have them overlap

– László Stahorszki
Jan 23 at 22:23

1

Okay so try this..... route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 followed by route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 but beforehand you might save the output of the route print somewhere to reference first. To delete those routes you can run route delete 10.8.0.0 and route delete 10.8.0.1.... Think hard about this, have backup of your route table too and be sure you can revert it back out of have a backout method just in case.

– Pimp Juice IT
Jan 23 at 22:26

1

If you add those two routes and there are problems, you can reboot too since they are not persistent so route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 first and then route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 next. If there are issues, reboot and do not run the route delete commands. Still have the route print output of the IPv4 first though.

– Pimp Juice IT
Jan 23 at 22:27

1

There has to be an IP on one subnet that can talk to an IP on another subnet that can then route via Layer 3 routing I think. I've configured static routes like that before on the client machines, and I've configured static routes in routers and firewalls too. There are other ways to do it with other protocols but for things like this, that's how I've handled some in the past. Maybe it will help or maybe not, let me know your thoughts.

– Pimp Juice IT
Jan 23 at 22:31

2

Let us continue this discussion in chat.

– Pimp Juice IT
Jan 23 at 22:46

|
show 2 more comments

I'm kind of confused by the question, because I only have one NIC (physical one at least), which is connected to the internet, via a router. the IP is 192.168.0.241. The VPN has a subnet of 10.8.0.0/24, and the computer in question has the address of 10.8.0.1. I was paying attention, not to have them overlap

– László Stahorszki
Jan 23 at 22:23

1

Okay so try this..... route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 followed by route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 but beforehand you might save the output of the route print somewhere to reference first. To delete those routes you can run route delete 10.8.0.0 and route delete 10.8.0.1.... Think hard about this, have backup of your route table too and be sure you can revert it back out of have a backout method just in case.

– Pimp Juice IT
Jan 23 at 22:26

1

If you add those two routes and there are problems, you can reboot too since they are not persistent so route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 first and then route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 next. If there are issues, reboot and do not run the route delete commands. Still have the route print output of the IPv4 first though.

– Pimp Juice IT
Jan 23 at 22:27

1

There has to be an IP on one subnet that can talk to an IP on another subnet that can then route via Layer 3 routing I think. I've configured static routes like that before on the client machines, and I've configured static routes in routers and firewalls too. There are other ways to do it with other protocols but for things like this, that's how I've handled some in the past. Maybe it will help or maybe not, let me know your thoughts.

– Pimp Juice IT
Jan 23 at 22:31

2

Let us continue this discussion in chat.

– Pimp Juice IT
Jan 23 at 22:46

I'm kind of confused by the question, because I only have one NIC (physical one at least), which is connected to the internet, via a router. the IP is 192.168.0.241. The VPN has a subnet of 10.8.0.0/24, and the computer in question has the address of 10.8.0.1. I was paying attention, not to have them overlap

– László Stahorszki
Jan 23 at 22:23

Okay so try this..... route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 followed by route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 but beforehand you might save the output of the route print somewhere to reference first. To delete those routes you can run route delete 10.8.0.0 and route delete 10.8.0.1.... Think hard about this, have backup of your route table too and be sure you can revert it back out of have a backout method just in case.

– Pimp Juice IT
Jan 23 at 22:26

If you add those two routes and there are problems, you can reboot too since they are not persistent so route add 10.8.0.0 mask 255.255.255.0 10.8.0.1 first and then route add 10.8.0.1 mask 255.255.255.255 192.168.0.241 next. If there are issues, reboot and do not run the route delete commands. Still have the route print output of the IPv4 first though.

– Pimp Juice IT
Jan 23 at 22:27

There has to be an IP on one subnet that can talk to an IP on another subnet that can then route via Layer 3 routing I think. I've configured static routes like that before on the client machines, and I've configured static routes in routers and firewalls too. There are other ways to do it with other protocols but for things like this, that's how I've handled some in the past. Maybe it will help or maybe not, let me know your thoughts.

– Pimp Juice IT
Jan 23 at 22:31

Let us continue this discussion in chat.

– Pimp Juice IT
Jan 23 at 22:46

|
show 2 more comments

1 Answer
1

active

oldest

votes

Sorry for my absence, I had other things to do in the meantime, but I did manage to solve the problem.

However, the solution is kind of disappointing. The only thing I needed to do was to enable masquerading on the public zone

answered Feb 2 at 15:19

László Stahorszki

1063

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1397662%2fho-to-route-one-subnet-to-another-using-firewalld-centos-7%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Sorry for my absence, I had other things to do in the meantime, but I did manage to solve the problem.

However, the solution is kind of disappointing. The only thing I needed to do was to enable masquerading on the public zone

answered Feb 2 at 15:19

László Stahorszki

1063

add a comment |

Sorry for my absence, I had other things to do in the meantime, but I did manage to solve the problem.

However, the solution is kind of disappointing. The only thing I needed to do was to enable masquerading on the public zone

answered Feb 2 at 15:19

László Stahorszki

1063

add a comment |

Sorry for my absence, I had other things to do in the meantime, but I did manage to solve the problem.

However, the solution is kind of disappointing. The only thing I needed to do was to enable masquerading on the public zone

answered Feb 2 at 15:19

László Stahorszki

1063

Sorry for my absence, I had other things to do in the meantime, but I did manage to solve the problem.

However, the solution is kind of disappointing. The only thing I needed to do was to enable masquerading on the public zone

answered Feb 2 at 15:19

László Stahorszki

1063

answered Feb 2 at 15:19

László Stahorszki

1063

answered Feb 2 at 15:19

László Stahorszki

1063

answered Feb 2 at 15:19

László Stahorszki

1063

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Super User!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Csdrhrt