1

I have several industrial machines. Each machine is an isolated network, 10.10.0.0/8, with three elements: A Raspberry Pi, a PLC, and an HMI. The IP addresses of the three components are static and they are the same for all machines. For example, the PLC is always at 10.10.0.50.

I am currently testing with a wifi network, 192.168.12.0/24. The wlan0 interface of the Raspberry Pi and my laptop are in this network.

This is a schema of our set-up:

Routing diagram

What I want is to gain access to the PLC of each machine from the wifi network. For example, I would like to reach the PLC in machine 1 using the address 192.168.12.128.

For this, the Raspberry Pi should be configured to forward packages and to do a NAT translation. The external address 192.168.12.128 arriving to wlan0 should be translated to 10.10.0.50 over eth0.

At this point, I can ping the PLC from the Raspberry Pi using 10.10.0.50 but it is not responding when I try with 192.168.12.128.

I have tried the following:

pi@raspberrypi:~ $ sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -t nat -A PREROUTING -d 192.168.12.128/32 -j DNAT --to-destination 10.10.0.50

So, my tables look like this:

pi@raspberrypi:~ $ sudo iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P POSTROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -d 192.168.12.128/32 -j DNAT --to-destination 10.10.0.50

pi@raspberrypi:~ $ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i eth0 -o wlan0 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT

and I put net.ipv4.ip_forward = 1 in /etc/sysctl.conf and I set /proc/sys/net/ipv4/ip_forward to 1 as well.

EDIT OF APRIL 23, 2020:

As before, I can ping the PLC from the Raspberry Pi using the 10.10.0.50 address, which uses the interface eth0. I still cannot ping 192.168.12.128. The destination host remains unreachable.

Running tcpdump over eth0 shows me the pings directed to 10.10.0.50, which succeed, but it does not show me those directed to 192.168.12.128. Therefore, my guess is that NAT is not working.

Running tcpdump over wlan0 and then pinging 192.168.12.128 shows a who-has ARP requests for each package sent. So, requests are not being forwarded to 10.10.0.50.

I did check that /proc/sys/net/ipv4/ip_forward is set to 1.

Help is greatly appreciated!

  • What is PLC and HMI? Each machine has a RasPi and there is an additional RasPi on network 192.168.12.0/24, right? It is difficult to have your setup in mind only from the textual description. Can you please provide a simple drawing? – Ingo Apr 15 at 15:15
  • A PLC and an HMI are devices which communicate with the Raspberry Pi over the Ethernet network 10.10.0.0. Each machine has a Raspberry Pi. There is no additional Raspberry Pi on 192.168.12.0/24; there, I have just my laptop. After reading your comment I improved my question and added a diagram; I hope my edit will be approved soon. – Julio Fraire Apr 21 at 15:45
3

The setting on the RasPi is OK so far. You do not need iptables rules

pi@raspberrypi:~ $ sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

but they don't hurt. It's all ACCEPTed in the FORWARD chain. But I would not set more than needed.

The quirks is on the PLC. It receives packages with source address from network 192.168.12.0/24. If you ping from 192.168.12.11, then the source address is just that but the PLC, residing on network 10.10.0.0/24, does not know where to send its replies to network 192.168.12.0/24. Just tell it that it has to send replies back to the RasPi with a route

plc:~ $ sudo ip route add 192.168.12.0/24 via 10.10.0.23

and it should do.

By the way: with this setting you are not able to connect to the RasPi direct from the network. You may consider to give the wlan0 interface a second ip address.

| improve this answer | |
  • In the PLC, the gateway is defined as 10.10.0.23, the Raspberry Pi. Ping packets are not reaching the eth0 interface of the Raspberry Pi when I ping 192.168.12.128. – Julio Fraire Apr 23 at 10:22
  • @JulioFraire Do you try to ping 192.168.12.128 from the PLC? This does not work with Destination NAT on the RasPi because NAT only works in one direction. Do you also need a connection from the PLC to network 192.168.12.0/24? That wasn't said in the question. Then an additional Source NAT on the RasPi may help, but haven't tested it yet. But ping from 192.168.12.128 to the PLC should work. Can confirm this? – Ingo Apr 23 at 12:54
  • Thank you, @Ingo. After your post I knew there was something even more basic going on. After assigning the PLC an address in a different network, I can indeed connect both to the Raspberry Pi and the PLC just fine (another take to your comment about giving wlan0 a second ip address). – Julio Fraire Apr 28 at 9:21
0

I have figured out my errors, so I am posting this in case it is useful.

The problem is that I was pinging the PLC at the new IP address from the Raspberry Pi. I was logged, either through the console or through SSH, into the Raspberry Pi. So, my pings did not go through the PREROUTING chain.

However, doing it through the laptop might have worked.

Moreover, it was not a good idea to assign the "external" IP address in the same network as the Raspberry Pi. I changed the new, external address of the PLC from 192.168.12.128 to 192.168.13.128, so that a new 192.168.13.0/24 network is now in place. I don't know if the old schema works or not.

So, with forwarding active, and as long as I ping the PLC from a device other than the Raspberry Pi, the following set-up does work:

pi@raspberrypi:~ $ sudo iptables -t nat -A PREROUTING -d 192.168.13.128/32 -j DNAT --to-destination 10.10.0.50
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.