<div dir="ltr"><div><div><div>Dear Alex,<br><br>Routes are "advertised" by your DHCP server. I assume that's on your router. What software are you using? I use 'dnsmasq'. To send your route out to all DHCP clients I would add:<br><br>dhcp-option=121,<a href="http://10.100.0.0/24,10.0.0.200" target="_blank">10.100.0.0/24,<wbr>10.0.0.200</a><br><br>to my dnsmasq configuration file and reload dnsmasq. Then all my clients would have to re-query the DHCP server to get the new route. But then all the clients should be able to talk to the <a href="http://10.100.0.0/24" target="_blank">10.100.0.0/24</a> network directly through the 10.0.0.200 gateway without involving your router at all.</div><div><br></div><div>That doesn't answer why your router won't send the packets destined for <a href="http://10.100.0.0/24" target="_blank">10.100.0.0/24</a> network on to the 10.0.0.200 gateway anyway. I assume the router is working otherwise. That the router has '/proc/sys/net/ipv4/ip_<wbr>forward' = 1 and it's not overridden in '/proc/sys/net/ipv4/conf/DEV/forwarding'. That iptables has a FORWARD rule which allows traffic to traverse the router. (iptables was new in the 2.6 kernel. It was ipchains in 2.4.)</div><div><br></div><div>I would run:</div><div><br></div><div>ip route list<br></div><div>cat /proc/sys/net/ipv4/ip_forward</div><div>cat /proc/sys/net/ipv4/conf/DEV/forwarding #where 'DEV' is the internal network interface<br></div><div>iptables -vnL FORWARD</div><div><br></div><div>and make sure that the router knows the gateway for the <a href="http://10.100.0.0/24">10.100.0.0/24</a> network, that it's set to forward (and not overruled on the internal network interface), and that iptables is allowing forwarding when a packet comes in and goes back out the internal interface.</div><div><br></div><div>HTH</div><div><br></div><div>Jeff<br></div><div><br> <div class="gmail_extra"><br><div class="gmail_quote">On Sat, Oct 21, 2017 at 2:05 PM, Alex Carver <span dir="ltr"><<a href="mailto:agcarver+ale@acarver.net" target="_blank">agcarver+ale@acarver.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Ok, I've tried every possible thing I could do to get routing to<br>
alternate gateways working correctly and nothing is working short of<br>
putting static routes on any machine that can handle them so I've got to<br>
ask for help again. Are there any security features in kernel 4.9 that<br>
perhaps weren't present way back in kernel 2.4 that would prevent a<br>
machine operating as the main gateway from issuing a reroute?<br>
<br>
If the primary gateway is <a href="http://10.0.0.1/24" rel="noreferrer" target="_blank">10.0.0.1/24</a> and I add a static route to send<br>
another network to a different machine:<br>
route -add net <a href="http://10.100.0.0/24" rel="noreferrer" target="_blank">10.100.0.0/24</a> gw 10.0.0.200<br>
<br>
What in the kernel would prevent this route from being advertised or<br>
otherwise handed to all clients on <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> when they attempt to<br>
respond to a packet coming from <a href="http://10.100.0.0/24" rel="noreferrer" target="_blank">10.100.0.0/24</a>? I can trace an incoming<br>
packet from <a href="http://10.100.0.0/24" rel="noreferrer" target="_blank">10.100.0.0/24</a>, through the 10.0.0.200 machine all the way to<br>
the <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> client, it replies and tries to send back to 10.100.0.0<br>
but the packet heads back towards 10.0.0.1 and never gets redirected<br>
back to 10.0.0.200.<br>
<br>
If I add the static route directly to the clients, the connections work.<br>
The problem is that I can't do that for every client, not all of them<br>
know how to handle routes on their own (not that I really should, this<br>
is the job of a router, no?)<br>
<br>
I'm certain it's some feature/setting of the kernel that's new in 4.9<br>
because this worked fine when the router was using the old 2.4 kernel.<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo</a><br>
</blockquote></div><br></div></div></div></div></div>