Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a question regarding OpenVPN and Linux NATing.

OpenVPN server (10.0.0.1) <--> (10.0.0.9) OpenVPN client (192.168.0.1) <--> (192.168.0.0/24) Internal LAN

I have set up a basic iptables rule on the client that says /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. With this, I can ping from the server to the internal LAN. However, when I look at the tcpdump on the server side, I see the internal LAN IP. I need to see the 10.0.0.9 IP of the OpenVPN server for classification reasons so I know where it went. Is there a way I can do another NAT on the return traffic so when the server sees the ping response, it comes from the 10.0.0.9 IP instead of the 192.168.0.X IP?

Thanks for your help.

Edit - I thought I would be able to do something like this but it doesn't seem to be working.

/sbin/iptables -t nat -A POSTROUTING -o tun0 -j SNAT --to-source 10.0.0.9
share|improve this question
    
Your diagram says "the server" IP is 10.0.0.1 yet the question states, "I need to see the 10.0.0.9 IP of the OpenVPN server." Which is it? Instead of using the terms client/server how about host-a,host-b or some other less confusing system. –  dfc Oct 18 '11 at 21:52
    
If you look at my diagram you see the server to client to internal LAN. (LanA <-> ServerA <-> ClientA <-> LanB) I am going to have multiple client's connecting to ServerA and I want to be able to distinguish which Client is sending me traffic by seeing the Client's tun0 address. Which in this case is 10.0.0.9. I know I can use different tun interfaces for each but I don't feel like dealing with 10+ tun interfaces. I'd rather be able to say if traffic is coming from 10.0.0.9 it is ClientA. Maybe 10.0.0.12 is ClientB, and so on. –  user22492 Oct 19 '11 at 13:27

2 Answers 2

Please specify what address you are pinging and from which host.

I assume that you ping 192.160.0.2 (or any other host in 192.160.0.0/24 different than 192.160.0.1) from 10.0.0.1 and you want the response to come from 10.0.0.9. And that is incorrect. IP protcol does not work this way. :-)

share|improve this answer
    
Initial request = 172.19.4.10 --> 10.0.0.1 --> 10.0.0.9 --> forward and NAT to 192.168.0.20 Response = 192.168.0.20 --> 10.0.0.9 --> 10.0.0.1 --> 172.19.4.10 (this address sees 192.168.0.20 as the source) I want to be able to NAT on the return traffic just like I did on the initial. If this is not possible, then I need another way to be able to distinguish ClientA's subnet from ClientB's subnet if they both use the same IP scheme. –  user22492 Oct 21 '11 at 19:30
    
Try using DNAT and SNAT instead of MASQUERADE. Maybe it will help... Maybe. :-) –  0xFF Oct 24 '11 at 12:40

If you didn't configure static IP for tun0 on the client, you must use MASQUERADE:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE

otherwise, you can use SNAT:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j SNAT --to-source 10.0.0.9
share|improve this answer
    
I've tried that solution and it doesn't appear to be working. I still see the response packet from the 192.168.0.0/24 subnet. –  user22492 Oct 11 '11 at 15:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.