0

Edit:

On a multi-router network, should a router (R2) behind the internet gateway (R1) run source NATing or masquerading if the gateway router is masquerading?

At this time I can ssh from a host on the gateway subnet (R1) to a server on the other subnet (R2), but attempts from the Internet time out.

Improve this question
4
  • 1
    You only NAT where you must: private<->public or overlapping addressing (should be a temporary situation).
    – Ron Maupin ♦
    Commented Jun 19 at 2:34
  • 2
    If R1 is doing NAT, what would be the point of R2 doing it, too? If you want the pseudo-firewall of NAT, use an actual firewall.
    – Ricky
    Commented Jun 19 at 2:35
  • Based on your two questions, it sounds like you are asking about using servers as routers and firewalls, and that is off-topic here.
    – Ron Maupin ♦
    Commented Jun 19 at 2:54
  • This sounds like a home networking question and you don't really know what your router actually does, just that sticking two of them together doesn't work well.
    – Stack Exchange Supports Israel
    Commented Jun 25 at 19:42

1 Answer 1

Reset to default
1

On a multi-router network, should a router (R2) behind the internet gateway (R1) run source routing

No. Source routing creates security problems and can only be used in fringe cases. Generally, it should be considered obsolete.

or masquerading if the gateway router is masquerading?

No. You only masquerade (NAT) where necessary, between different address domains (usually public vs. private). Multiple NAT stages can become very difficult to handle.

Routers within private address space or within public address space should always use plain routing.

I can ssh from a host on the gateway subnet (R1) to a server on the other subnet (R2), but attempts from the Internet time out.

You might have multiple NAT stages and have missed setting up destination NAT aka reverse NAT aka port forwarding on the outer one. Alternatively, a firewall rule is missing or your ISP is blocking the connection. Run packet captures on the gateways to debug.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.