I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (1.1.1.1/32 & 2.2.2.2/32)
On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.
I am also able to reach those services from both ends of the VPN - so 1.1.1.1/32 and 2.2.2.2/32.
Now I have few other subnets connected to the 2.2.2.2/32 box:
10.0.3.0/24 10.0.4.0/24 ....
(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 1.1.1.1 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 1.1.1.1 with source change. So I did that in the following way:
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 1.1.1.1 -j SNAT --to-source 2.2.2.2 iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 1111 -j DNAT --to-destination 1.1.1.1
But now, when I try to connect to that service, I am getting "No route to host" error:
telnet 10.0.0.1 1111 Trying 10.0.0.1... telnet: Unable to connect to remote host: No route to host
So I'm bit puzzled. I think the problem might be in the routing on the Debian box:
2.2.2.2 via 1.1.1.1 dev eth0 src 1.1.1.1
However, I am not quite sure why it does not work?
Routing from the Debian box:
10.0.0.0/27 dev eth1 proto kernel scope link src 10.0.0.1 10.0.2.0/24 via 10.0.0.2 dev eth1 10.0.3.0/24 via 10.0.0.3 dev eth1 10.0.4.0/24 via 10.0.0.4 dev eth1 10.0.5.0/24 via 10.0.0.5 dev eth1 10.0.6.0/24 via 10.0.0.6 dev eth1 10.0.7.0/24 via 10.0.0.7 dev eth1 1.1.1.1 via 2.2.2.2 dev eth0 src 2.2.2.2
Any ideas what can be wrong?
telnet 1.1.1.1 1111
instead oftelnet 10.0.0.1 1111
?