I have several industrial machines. Each machine is an isolated network, 10.10.0.0/8, with three elements: A Raspberry Pi, a PLC, and an HMI. The IP addresses of the three components are static and they are the same for all machines. For example, the PLC is always at 10.10.0.50.
I am currently testing with a wifi network, 192.168.12.0/24. The wlan0 interface of the Raspberry Pi and my laptop are in this network.
This is a schema of our set-up:
What I want is to gain access to the PLC of each machine from the wifi network. For example, I would like to reach the PLC in machine 1 using the address 192.168.12.128.
For this, the Raspberry Pi should be configured to forward packages and to do a NAT translation. The external address 192.168.12.128 arriving to wlan0 should be translated to 10.10.0.50 over eth0.
At this point, I can ping the PLC from the Raspberry Pi using 10.10.0.50 but it is not responding when I try with 192.168.12.128.
I have tried the following:
pi@raspberrypi:~ $ sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT pi@raspberrypi:~ $ sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT pi@raspberrypi:~ $ sudo iptables -t nat -A PREROUTING -d 192.168.12.128/32 -j DNAT --to-destination 10.10.0.50
So, my tables look like this:
pi@raspberrypi:~ $ sudo iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P POSTROUTING ACCEPT -P OUTPUT ACCEPT -A PREROUTING -d 192.168.12.128/32 -j DNAT --to-destination 10.10.0.50 pi@raspberrypi:~ $ sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -i eth0 -o wlan0 -j ACCEPT -A FORWARD -i wlan0 -o eth0 -j ACCEPT
and I put
net.ipv4.ip_forward = 1 in /etc/sysctl.conf and I set /proc/sys/net/ipv4/ip_forward to 1 as well.
EDIT OF APRIL 23, 2020:
As before, I can ping the PLC from the Raspberry Pi using the 10.10.0.50 address, which uses the interface eth0. I still cannot ping 192.168.12.128. The destination host remains unreachable.
Running tcpdump over eth0 shows me the pings directed to 10.10.0.50, which succeed, but it does not show me those directed to 192.168.12.128. Therefore, my guess is that NAT is not working.
Running tcpdump over wlan0 and then pinging 192.168.12.128 shows a who-has ARP requests for each package sent. So, requests are not being forwarded to 10.10.0.50.
I did check that /proc/sys/net/ipv4/ip_forward is set to 1.
Help is greatly appreciated!