1

I'm trying to create two networks (using a debian server) :

  • The first one is intended to pass packets in a normal way (to my ISP).
  • The second one is intended to pass packets via a L2TP/IPSec VPN connection that I'm establishing at boot.

My current topology is :

  • eth0 is connected to my ISP router : (192.168.1.0/24)
  • eth1 (10.0.0.1) is connected to my lan (10.0.0.0/16)
  • eth1:1 (10.1.0.1) is connected to my lan (10.1.0.0/16)
  • ppp0 is my L2TP/IPSec connection

If a client is using 10.0.0.1 as a router, he gets through eth0, if a client is using 10.1.0.1 as a router he gets though ppp0. So, to achieve that, i've created this 2 IPTables rules :

  • iptables -A POSTROUTING -t nat -o eth0 -s 10.0.0.0/16 -j MASQUERADE
  • iptables -A POSTROUTING -t nat -o ppp0 -s 10.1.0.0/16 -j MASQUERADE

The first network (10.0.0.0/16) is working well, the nat masquerade works great. But for the second one (10.1.0.0/16) it's not working at all.

I'm sure that ppp0 is working because if I change the default route on my server to use the ppp0 address a traceroute google.com shows me that I'm going though the VPN.

My question is : why it's not working with the nat ?

2 Answers 2

1

Your problem most likely comes from the encryption your IPSec tunnel is encapsulating your packet in. You need destination and source headers for Natting to forward your packets correctly, however your IPSec tunnel is encapsulating those packets and encrypting them, making it impossible for your router to direct the traffic.

Depending on your router model and build there are some common solutions. Cisco hardware can work around this with an access control list

Referencing documentation: VPN and Natting explained

3
  • I think I'm going to give a try to PPTP so :)
    – Bahaïka
    Aug 29, 2014 at 13:20
  • What kind of router are you using? You'll probably have better luck debugging on your router. On a cisco router you can use 'show asp drop' to view why packets are being dropped.
    – Reaces
    Aug 29, 2014 at 14:06
  • I have a completly locked router from my ISP and a Debian Box behind it...
    – Bahaïka
    Aug 29, 2014 at 17:22
1

I suspect there is an issue with your routing rules. You need to specify what destination addresses go out which interfaces. Its probably all just going out the default gateway currently. Those POSTROUTING rules get applied after the routing gets done.

4
  • Since I can't reach anything using the 10.1.0.0 network, I think it's going out on the default route. How can I check if it's doing it ?
    – Bahaïka
    Aug 29, 2014 at 13:19
  • 'route -n' to view the route table. Check if you have any remote networks/addresses that are set to go out ppp0. You could do something like 'route add -host 8.8.8.8 gw 10.1.x.x dev ppp0' replacing 10.1.x.x with the gateway address for that network. you can use 'tcpdump -i ppp0' to see whats going out that device. open another window, and try ping 8.8.8.8, vs pinging other addresses.
    – bandito
    Aug 29, 2014 at 13:28
  • Then 10.1.0.1 network haven't any gateway, I want to use the ppp0 as the gateway. Is it possible ? If I do a route add -host 8.8.8.8 gw $ppp0IP dev ppp0 I can ping 8.8.8.8 though the VPN, but the VPN is forced for eveybody on both networks.
    – Bahaïka
    Aug 29, 2014 at 13:50
  • After some checks, I'm quite sur that's what you said is the issue i'm facing, but I can't find a way to do make it works...
    – Bahaïka
    Aug 29, 2014 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .