I have the following setup
- Server (192.168.21.11, 172.17.4.6), that routes 10.10.10.0/24 through OpenVPN
- Client (192.168.21.9)
- Router (192.168.21.1) [m0n0wall] that has a static route for 10.10.10.0/24 to 192.168.21.11
On the Server, NAT forwarding is enabled:
/sbin/iptables -t nat -A POSTROUTING -d 10.10.10.0/24 -o tun0 -j MASQUERADE
# cat /proc/sys/net/ipv4/ip_forward
1
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I'm able to do a traceroute from the client to the server
# traceroute 10.10.10.10
traceroute to 10.10.10.10 (10.10.10.10), 30 hops max, 60 byte packets
1 (192.168.21.1) 0.283 ms 0.211 ms 0.165 ms ## Router
2 (192.168.21.11) 0.262 ms 0.249 ms 0.213 ms ## Server
3 (172.17.4.1) 40.356 ms 83.965 ms 83.915 ms ## OpenVPN Subnet
4 (10.10.10.10) 83.778 ms 83.626 ms 83.488 ms
But I'm somehow unable to connect from the client to the server. Here's what tcpdump reports, when I try to connect through SSH to the server:
# tcpdump -i tun0
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
08:05:16.734848 IP 172.17.4.6.58710 > 10.10.10.10.ssh: S 2851123862:2851123862(0) win 5840 <mss 1460,sackOK,timestamp 597224955 0,nop,wscale 6>
08:05:16.776264 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296951268 597224955,nop,wscale 5>
08:05:20.986415 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296952321 597224955,nop,wscale 5>
08:05:26.985854 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296953821 597224955,nop,wscale 5>
It seems as though the packets from the server aren't routed back to the client.