I am using a Strongswan VPN server on a Debian Squeeze machine. The incoming VPN clients get an IP of the 192.168.99.0/24 subnet.
As I am using this VPN mainly to have encryption when using non-encrypted WLANs I am doing a source NAT into the internet using iptables. (I prefere source NATing because the server has a static ipv4 adress.)
At the moment I am using the following iptables command
# used for StrongSWAN iptables -t nat -I POSTROUTING -s 192.168.99.0/24 -o eth0 -j SNAT --to-source <public IP adress of server>
My question is: when using this rule, every traffic that is incoming from this 192.168.99.0/24 subnet is now accepted and NATted. I would like to be more specific that only traffic that entered the server through this VPN tunnel is accepted by this rule.
In a classic router setup with two network devices I would check for the incoming device to achieve that. Is there something equivalent in Strongswan (e.g. virtual network devices)?
How can I filter out the packets that reached the server through the tunnel so that only these packets are NATed?