Configure NAT in Vyos Router

Question

I have the following diagram, and I want that R2 and each client connected with R2 have access to the internet. For that I configured NAT in R1 with the following commands:

#set nat source rule 10 outbound-interface eth0
#set nat source rule 10 source address 10.0.0.0/30
#set nat source rule 10 translation address masquerade
#commit
#save

I'm able to ping the internet from R1, but I can not from R2 or from any of the clients. However if I powered off R2, and in its place plugin a client directly to the R1 eth1 interface, the client can ping the internet. Can you help me? What kind of configuration should I do in R2? Thanks.

Answer 1

Agree with @Zac67 answer

To do so here are the commands:

On R1

set protocol static route 192.168.10.0/24 next-hop 10.0.0.2
set protocol static route 192.168.20.0/24 next-hop 10.0.0.2
set protocol static route 192.168.30.0/24 next-hop 10.0.0.2
set nat source rule 21 outbound-interface eth0
set nat source rule 21 source address 192.168.10.0/24
set nat source rule 21 translation address masquerade
set nat source rule 22 outbound-interface eth0
set nat source rule 22 source address 192.168.20.0/24
set nat source rule 22 translation address masquerade
set nat source rule 23 outbound-interface eth0
set nat source rule 23 source address 192.168.30.0/24
set nat source rule 23 translation address masquerade

Note that just removing the line nat source rule 10 source address 10.0.0.0/30 instead of making new NAT rules would work also as it would NAT all traffic egressing on eth0 but personally I prefer having separate rules, because this allow:

• to disable a specific rules
• to enable logging on a specific rule
• more generally ease the debuging in case of issues

You could also make a single route and a single NAT rule with 192.168.0.0/16 instead of managing each 192.169.X.0 subnet individually.

On R2

set protocol static route 0.0.0.0/0 next-hop 10.0.0.1

Answer 2

R1 needs to know what's behind R2. Either configure a dynamic routing protocol like OSPF on both routers or set up static routes on R1.

If there are no other networks elsewhere you could simply use 192.168.0.0/16 via gateway 10.0.0.2 (I don't know the syntax on Vyos).

On R2 you need a default route pointing to R1, of course.

Also, you need to tell R1 to translate source IP addresses 192.168.0.0/16 as well.