2

For some hours I'm already trying to setup a virtual private network between two physical locations (Location A, 192.168.1.0/24), and (Location B, 192.168.2.0/24). I am forced to use a tunnel instead of bridged networking. 192.168.4.0/24 is the VPN network. The connection between the two locations works fine, server has 192.168.4.1 and the client 192.168.4.6. But now I want the server to access a server on the client-side network, which address is 192.168.1.44.

How do I achive this with routes and iptable entries (presumably NAT postrouting?)?

1 Answer 1

1

Try this.

On the server:

route add -net 192.168.1.0/24 gw 192.168.4.6

On the client:

iptables -t nat -I POSTROUTING -s 192.168.4.1 -t 192.168.1.44 -j SNAT --to 192.168.4.1

That alone should probably work. Read on if you want to consider other options though.

You should be able to do without the iptables rule if the client happens to be the default gateway for the 192.168.1.0/24 network of if you add this route in either the destination server or its default gateway:

route add -net 192.168.2.0/24 gw <IP_of_client_on_this_network>

You can also replace net 192.168.1.0/24 with just 192.168.1.44 (etc.) if you want only that server to be reachable - but if you mean to be filtering you should probably add a separate filter rule on the server and/or client.

If you are already filtering on the client (I mean if you have FORWARD rules, see iptables -nvL) you have to add another rule there:

iptables -I FORWARD -i tun+ -s 192.168.4.1 -d 192.168.1.44 -j ACCEPT

Edit: deleted -i from the POSTROUTING rule, that was a mistake.

2
  • Thanks for your reply. The route should do the job, but it doesnt seem to work properly. I have tshark running on both machines to monitor ping requests to the target machine. I've added the route as you've posted above, which results into outgoing packets on the server side (without the route, they are not sent of course), but on the client side, it does not monitor any packets on the tun0 device.
    – anonvpn
    May 2, 2011 at 12:45
  • Can you ping 192.168.4.6 from the server? Do you see the ICMP packets on the tun0 device on the client then? May 2, 2011 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .