Dual-Network Router Lab Playground

Overview

This playground contains five Ubuntu 24.04 VMs arranged into two separate Layer 2 networks. Four VMs are ordinary hosts, while box-05 is dual-homed and routes traffic between the two subnets.

The private subnet is deliberately air-gapped from the Internet. Its hosts can communicate with the public-side VMs through the router, but the router does not perform NAT or masquerading for them.

Topology

Private network

• Name: private
• Subnet: 10.10.0.0/24
• Members: box-01, box-02, and the private interface of box-05
• Marked private: true, so the platform supplies neither a default route nor Internet NAT
• Hosts route the public subnet through 10.10.0.254

Public network

• Name: public
• Subnet: 10.20.0.0/24
• Members: box-03, box-04, and the public interface of box-05
• Uses the platform-provided default route through 10.20.0.1
• Hosts route the private subnet through 10.20.0.254

Routing setup

An init task enables IPv4 forwarding on box-05:

printf 'net.ipv4.ip_forward=1\n' > /etc/sysctl.d/99-router.conf
sysctl --system

The leaf VMs receive these static routes:

# box-01 and box-02
ip route replace 10.20.0.0/24 via 10.10.0.254

# box-03 and box-04
ip route replace 10.10.0.0/24 via 10.20.0.254

No NAT rules are installed on box-05. Consequently, private hosts can reach the public subnet but cannot use the router as an Internet gateway.

Expected connectivity

Quick checks

From box-01, confirm that cross-subnet routing works while Internet access remains unavailable:

ip route
ping -c 2 10.20.0.10
ping -c 2 1.1.1.1  # expected to fail

From box-03, test the reverse route and Internet connectivity:

ping -c 2 10.10.0.10
ping -c 2 1.1.1.1

On box-05, inspect both interfaces and verify forwarding:

ip -brief address
ip route
sysctl net.ipv4.ip_forward

The last command should print net.ipv4.ip_forward = 1.