Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to connect my network to an IPSec VPN, and for this my connexions need to come from a given domain. The network is the following:

Internal network    eth1:10.0.0.1/14      eth0:1.2.3.4
----------------------------------- MY GW -----------------+
                                                           |
                                                           |
             192.168.178.4               4.5.6.7           |
        SERVER ------------------- VPN GW -----------------+

I'm required to be seen by the VPN network as coming from 172.30.224.0/28, so on my gateway I've added the following iptables rule:

iptables -t nat -A POSTROUTING -d 192.168.178.4 -j SNAT --to-source 172.30.224.1

Then, from my internal network, when I ping the 192.168.178.4 I get the request on eth1 and the response on eth0:

# tcpdump -n -i eth1 host 192.168.178.4
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
15:49:49.854809 IP 10.2.1.172 > 192.168.178.4: ICMP echo request, id 3472, seq 1, length 64
15:49:52.170758 IP 10.2.1.172 > 192.168.178.4: ICMP echo request, id 3479, seq 1, length 64
15:49:53.178692 IP 10.2.1.172 > 192.168.178.4: ICMP echo request, id 3479, seq 2, length 64
# tcpdump -n -i eth0 host 192.168.178.4
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:50:36.492856 IP 192.168.178.4 > 172.30.224.1: ICMP echo reply, id 3494, seq 1, length 64
15:50:37.465803 IP 192.168.178.4 > 172.30.224.1: ICMP echo reply, id 3494, seq 2, length 64

The problem is that my response never reaches back my host (10.2.1.172 in this case).

The gateway is also configured to do SNAT for the internal network to internet.

I'm surely missing something here but I'm stuck. Any help would be greatly appreciated.

share|improve this question
    
Could you post the result of the route command on your gateway? –  Nosax Sep 12 '12 at 14:05
    
It's also possible that the NAT is working fine but the firewall's not allowing it; could we get the output of iptables -L -n -v and iptables -t nat -L -n -v (on the gateway) in the question as well? –  MadHatter Sep 12 '12 at 14:15
    
@Nosax here it is, a little edited to hide the real IPs... Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 1.2.3.0 0.0.0.0 255.255.255.248 U 0 0 0 eth0 10.0.0.0 0.0.0.0 255.252.0.0 U 0 0 0 eth1 0.0.0.0 1.2.3.5 0.0.0.0 UG 100 0 0 eth0 –  ebernard Sep 12 '12 at 17:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.