Welcome to the Linux Foundation Forum!

Debian Stretch and 2 different networks


Hello, guys! How are you?

I'm facing a problem. I have 2 networks ( and and what happen is this: in the 1st network ( there's a gateway ( to the Internet, and the 2nd network needs to pass through the 1st network to reach Internet.
To connect both networks, I have 2 servers (Debian "Stretch" 9.6.0) working as MASTER and SLAVE, and the idea is to use them as gateway for the 2nd network, like this:

[INTERNET] --- [1st GATEWAY] --- [] --- [2nd GATEWAY (Servers MASTER/SLAVE: Debian)] --- []
Both servers are using enp0s3 to connect to and enp0s8 to connect to, and they are working as DNS and DHCP for

I tried to add a default route to (my 1st gateway) like this:

route add dev enp0s8 (interface connected to my 2nd network)

route add default gw

But when I try to install Debian in a client on, during the network auto detection, it says there's no default route to Internet. When I proceed the installation (pointing to the server the installer tries to set a repository mirror but it fails, saying that it wasn't possible to get that mirror, either because the network (repository) is unreachable or because the repository is broken/offline.
About Windows client, when I am setting Primary and Secondary DNS, instead of use and as my DNS for, I need to set as Primary DNS.

My network interfaces are set like this:

cat /etc/network/interfaces

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

auto enp0s3
iface enp0s3 inet static
address # 2nd server:

auto enp0s8
iface enp0s8 inet static
address # 2nd server:

Also, my DHCP is set like this (with failover setting):

cat /etc/dhcp/dhcpd.conf

Master Server // The Slave Server is almost equal, except few details to make it work as FAILOVER server

ddns-update-style interim;
option domain-name "mynetwork.local";
option domain-name-servers ns1.mynetwork.local, ns2.mynetwork.local,,;
default-lease-time 600;
max-lease-time 7200;
log-facility local7;

failover peer "DHCP-FAILOVER" {
port 647;

peer address;
peer port 647;

max-response-delay 30;
max-unacked-updates 10;

load balance max seconds 3;
mclt 1800;
split 128;


subnet netmask {
option routers,;
option subnet-mask;
option domain-name "mynetwork.local";
option domain-name-servers,;

option netbios-dd-server,;
option netbios-name-servers,;
option netbios-node-type 8;

option nis-domain "mynetwork.local";
option nis-servers,;
option nisplus-domain "mynetwork.local";
option nisplus-servers,;

option ntp-servers,;

option time-offset -18000;

pool {
    failover peer "DHCP-FAILOVER";


And, finally, my firewall script is this:


modprobe iptable_nat
modprobe iptable_filter
modprobe iptable_mangle
modprobe ipt_MASQUERADE
modprobe ip_tables
modprobe nf_conntrack
modprobe nf_conntrack_ipv4
modprobe nf_nat
modprobe nf_tables
modprobe nf_tables_ipv4
modprobe nft_masq
modprobe nft_masq_ipv4
modprobe nft_nat
modprobe nft_redir
modprobe nft_redir_ipv4

iptables -t filter -F
iptables -t mangle -F
iptables -t nat -F

iptables -P INPUT DROP
iptables -P FORWARD DROP

EXTERNAL_NETWORK= # My 1st network
EXTERNAL_INTERFACE=enp0s3 # Interface connected to
INTERNAL_NETWORK= # My 2nd network
INTERNAL_INTERFACE=enp0s8 # Interface connected to

Getting hostname to set the variable "SRV_IP_ADDR"

[[ $(hostname) = master ]] && SRV_IP_ADDR= || SRV_IP_ADDR=

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i $EXTERNAL_INTERFACE -j ACCEPT # Interface enp0s3

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Accepting SSH connections

iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp --dport 1024 -j ACCEPT
iptables -A INPUT -s $EXTERNAL_NETWORK/24 -p tcp --dport 1024 -j ACCEPT

If a package goes to the internet (external network), it must return to the internal network

iptables -A FORWARD -d $INTERNAL_NETWORK/24 -p tcp -j ACCEPT
iptables -A FORWARD -s $INTERNAL_NETWORK/24 -p tcp -j ACCEPT

Accepting WWW, WWWS, DHCP and DNS connections/queries

iptables -A FORWARD -s $SRV_IP_ADDR -m multiport -p tcp --dport 80,443 -j ACCEPT
iptables -A FORWARD -d $SRV_IP_ADDR -m multiport -p tcp --sport 80,443 -j ACCEPT

These 2 lines bellow are for TCP

iptables -A FORWARD -s $INTERNAL_NETWORK/24 -m multiport -p tcp --dport 53,67 -j ACCEPT
iptables -A FORWARD -d $INTERNAL_NETWORK/24 -m multiport -p tcp --sport 53,67 -j ACCEPT

These 2 lines bellow are for UDP

iptables -A FORWARD -s $INTERNAL_NETWORK/24 -m multiport -p udp --dport 53,67 -j ACCEPT
iptables -A FORWARD -d $INTERNAL_NETWORK/24 -m multiport -p udp --sport 53,67 -j ACCEPT

What do I need to do to make my servers work as gateway / Primary-Secondary DNS for
And how do I set a default route from --->

Thank you for your attention.


Upcoming Training