How to set up routing through a Linux server with a single network adapter?

Question

linux

I have a local network. There is a router to which I do not have full access and I cannot configure routing on it (MGTS router - there is access to iptables, but there is no access to ip route). I want to make it possible to route traffic. There is a Linux server on which, for example, 2 VPN clients are running - one VPN for a neighboring local network, the second VPN for another local network. The server has one network card. For ordinary clients, the issue was resolved simply - I run DHCP on my Linux server and add routes to DHCP. But for Android clients this does not work - they only use the default gateway. Therefore, I want all ip traffic from Android clients to go through my Linux server on which I would route everything correctly. Most instructions describe how to set up NAT, And as a rule with 2 network interface cards (which is logical). And how to make routing if the card is one.

I tried to stupidly enable net.ipv4.ip_forward=1 on the Linux server and use it as the default gateway on the client. But it didn't work.

You can, of course, hack it up and pretend that the server is on a different subnet.
Let's say the router is 192.168.1.1/24
Server 192.168.1.2
VPN1: 192.168.2.0, VPN2: 192.168.3.0

We hang 2 interfaces on one server adapter - eth0, eth0:0. We make the first interface 192.168.2.1/25. Add a second interface to the eth0:0 server and assign it the IP 192.168.1.128/25. We give the Android client the address 192.168.1.129 and assign the default gateway 192.168.1.128. Firstly, some kind of game, and secondly, I'm not sure that it will work. How to do it correctly and simply?

Answer 1

How many network cards are in Linux - it doesn't really matter, virtual interfaces work exactly the same as real ones. You can hang as many addresses as you like on one physical interface and route to your health.

Answer 2

Most of the instructions describe how to set up NAT, and usually with 2 network cards (which is logical)

I don't know how logical this is; I try to write rules more universally, not binding to interfaces unnecessarily. For your case:

-A POSTROUTING -s 192.168.1.0/25 ! -d 192.168.1.0/25 -j MASQUERADE

We hang 2 interfaces on one server adapter - eth0, eth0:0. We make the first interface 192.168.2.1/25. Add a second interface to the eth0:0 server and assign it the IP 192.168.1.128/25.

Interface aliases are deprecated.
https://www.kernel.org/doc/html/latest/networking/...

IP aliases are an obsolete way to manage multiple IP addresses/masks per interface. Newer tools such as iproute2 support multiple address/prefixes per interface, but aliases are still supported for backwards compatibility.

2014: Interface aliases are deprecated. https://unix.stackexchange.com/questions/119592/su...

ens160:0 is also obsolete syntax. There is no more aliases usage. IP addresses are applied to the same interface (please see ip as command output).

2007: Interface aliases are deprecated.
https://linux.debian.user.narkive.com/jH7FZrwF/ip-...

The docs I'm reading recommend using "secondary ips" instead of aliases. It
says that IP Aliases are deprecated in favor of "secondary ips"

2007! 14 years ago we were told to stop using IP aliases. 14 years ago Carl!

Answer 3

Everything should work out of the box. I just had `DENY` in iptables *filter `DEFAULT FORWARD policy`. Found out by enabling TRACE in iptables.