I have big problem with connecting from my LAN to remote VPN. Between my LAN and Network there is Linux box with iptables rules. Below is what I've added to iptables to enable connection from specific computer in LAN:
iptables -t nat -A PREROUTING -i 10.0.0.66 -p tcp --dport 1723 -j DNAT --to 123.123.123.123
iptables -A FORWARD -i 10.0.0.66 -p tcp --dport 1723 -d 123.123.123.123 -j ACCEPT
iptables -t nat -A PREROUTING -i 10.0.0.66 -p 47 -j DNAT --to 123.123.123.123
iptables -A FORWARD -i 10.0.0.66 -p 47 -d 123.123.123.123 -j ACCEPT
Unfortunately this doesn't solve the problem. So I've added logging options:
iptables -A FORWARD -d 123.123.123.123 -j LOG --log-prefix="VPN "
iptables -A FORWARD -s 123.123.123.123 -j LOG --log-prefix="VPN "
This is what I get:
Jul 21 17:08:05 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=556 TOS=0x00 PREC=0x00 TTL=127 ID=28261 PROTO=UDP SPT=500 DPT=500 LEN=536
Jul 21 17:08:06 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=556 TOS=0x00 PREC=0x00 TTL=127 ID=28262 PROTO=UDP SPT=500 DPT=500 LEN=536
Jul 21 17:08:08 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=556 TOS=0x00 PREC=0x00 TTL=127 ID=28265 PROTO=UDP SPT=500 DPT=500 LEN=536
Jul 21 17:08:12 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=28270 DF PROTO=TCP SPT=50194 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0
Jul 21 17:08:15 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=28272 DF PROTO=TCP SPT=50194 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0
Jul 21 17:08:21 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=28311 DF PROTO=TCP SPT=50194 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=28318 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=8192 RES=0x00 SYN URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=48 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=5840 RES=0x00 ACK SYN URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=28319 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64240 RES=0x00 ACK URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=196 TOS=0x00 PREC=0x00 TTL=127 ID=28320 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64240 RES=0x00 ACK PSH URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=55274 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=6432 RES=0x00 ACK URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=196 TOS=0x00 PREC=0x00 TTL=59 ID=55275 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=6432 RES=0x00 ACK PSH URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=208 TOS=0x00 PREC=0x00 TTL=127 ID=28322 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64084 RES=0x00 ACK PSH URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=72 TOS=0x00 PREC=0x00 TTL=59 ID=55276 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=7504 RES=0x00 ACK PSH URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=64 TOS=0x00 PREC=0x00 TTL=127 ID=28323 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64052 RES=0x00 ACK PSH URGP=0
Jul 21 17:08:34 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28324 PROTO=47
Jul 21 17:08:34 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=55277 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=7504 RES=0x00 ACK URGP=0
Jul 21 17:08:36 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28332 PROTO=47
Jul 21 17:08:39 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28336 PROTO=47
Jul 21 17:08:43 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28340 PROTO=47
Jul 21 17:08:47 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28345 PROTO=47
Jul 21 17:08:51 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28349 PROTO=47
Jul 21 17:08:55 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28352 PROTO=47
Jul 21 17:08:59 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28378 PROTO=47
Jul 21 17:09:03 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=57 TOS=0x00 PREC=0x00 TTL=127 ID=28381 PROTO=47
Jul 21 17:09:04 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=55278 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=7504 RES=0x00 ACK FIN URGP=0
Jul 21 17:09:04 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=28382 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64052 RES=0x00 ACK URGP=0
Jul 21 17:09:04 [kernel] VPN IN=eth1 OUT=eth0 SRC=10.0.0.66 DST=123.123.123.123 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=28383 DF PROTO=TCP SPT=50195 DPT=1723 WINDOW=64052 RES=0x00 ACK FIN URGP=0
Jul 21 17:09:04 [kernel] VPN IN=eth0 OUT=eth1 SRC=123.123.123.123 DST=10.0.0.66 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=TCP SPT=1723 DPT=50195 WINDOW=7504 RES=0x00 ACK URGP=0
And of course connection failed. Where I made a mistake? Does anybody knows how to set up iptables firewall to allow LAN user access to external VPN (SSTP) ? Thank you in advance for any help or clues.
Regards Piotr
