WRT54G2 with Subnetted Virtual Machines

Question

I am unable to access the internet from guest virtual machines on a /25 subnet, although local lan connectivity seems to work fine, and local lan access to the internet works fine. My setup: WRT54G2 in Gateway mode 10.100.200.1/25 Host machine 10.100.200.4/25 Guests (Virtual machines) on the host: : 10.100.200.128 -254 (Host and Guests are Ubuntu 10.11 under KVM, w/virt-manager "routed networking" Static route on WRT54G2: 10.100.200.128/25 gw: 10.100.200.4 Local LAN connectivity is complete. For example, ssh from the lan to any guest works, as does ssh from any guest to any lan machine. Local lan internet access is complete, includiing the vm Host. Ping and traceroute from the WRT54G2 to lan machines, Host, and guests is successful. Failure: Guest machines cannot reach the internet. They can reach the router. Traceroute to an internet address from a guest machine returns responses from the WRT54G2, followed by time-outs. Ping from a guest machine to the internet fails. I have experimented with both /25 and /24 subnet masks on the WRT54G2 lan port without apparent effect. At this point I am rapidly running out of ideas. The WRT54G2 seems to refuse to pass guest machine packets out to the internet. I have found suggestions on various web fora that NAT difficulties can arise when using subnets with the WRT54G2, but I've been unable to track down details. Any suggestions would be deeply appreciated. Thanks in advance...

Answer 1

Linksys routers are consumer routers. They don't really support more complex network configurations.
In your case, the problem is that the WRT only does NAT for it's own LAN IP subnet.
If a computer inside your LAN (e.g. 10.100.200.4/25) sends something into the internet, the WRT will do source IP NAT from 10.10.200.4 to its public IP address. This happens for all source IP addresses inside 10.100.200.4/25 but not for any other IP address.
This means, if your VM with 10.100.200.200/25 would send something, it is routed through the host machine to the WRT, i.e. the WRT receives a packet from 10.100.200.200 to an internet IP address for forwarding. As the source IP address is not in 10.100.200.0/25 it won't go through NAT, i.e. the WRT will route the packet with unmodified source IP address 10.100.200.200 into the internet where it will be quickly discarded.
That's a known limitation of Linksys routers and they don't have any configuration options to configure the NAT function in detail (like you would find in a Cisco IOS router). The Linksys always does NAT for the LAN IP subnet but for nothing else.
You only have two options:
1. use NAT on the host machine, i.e. the host machine does NAT between the VMs and the host network. Of course this way, the VMs are not accessible from the outside.
2. use ethernet bridging instead of routing between VMs and host network. This would create a single ethernet network and you only need a single LAN IP subnet for VMs and the normal network.