Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (1.1.1.1/32 & 2.2.2.2/32)

On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.

I am also able to reach those services from both ends of the VPN - so 1.1.1.1/32 and 2.2.2.2/32.

Now I have few other subnets connected to the 2.2.2.2/32 box:

10.0.3.0/24
10.0.4.0/24
.... 

(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 1.1.1.1 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 1.1.1.1 with source change. So I did that in the following way:

iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 1.1.1.1 -j SNAT --to-source 2.2.2.2
iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 1111 -j DNAT --to-destination 1.1.1.1

But now, when I try to connect to that service, I am getting "No route to host" error:

telnet 10.0.0.1 1111
Trying 10.0.0.1...
telnet: Unable to connect to remote host: No route to host

So I'm bit puzzled. I think the problem might be in the routing on the Debian box:

2.2.2.2 via 1.1.1.1 dev eth0  src 1.1.1.1

However, I am not quite sure why it does not work?

Routing from the Debian box:

10.0.0.0/27 dev eth1  proto kernel  scope link  src 10.0.0.1
10.0.2.0/24 via 10.0.0.2 dev eth1
10.0.3.0/24 via 10.0.0.3 dev eth1
10.0.4.0/24 via 10.0.0.4 dev eth1
10.0.5.0/24 via 10.0.0.5 dev eth1
10.0.6.0/24 via 10.0.0.6 dev eth1
10.0.7.0/24 via 10.0.0.7 dev eth1
1.1.1.1 via 2.2.2.2 dev eth0  src 2.2.2.2

Any ideas what can be wrong?

share|improve this question
1  
I was trying to draw you network, but I wasn't able to... can you please be a little more specific of which net are behind which interface of which machine? Do you have two VPN machines, right? Both Debian? This was as far as I could get: sdrv.ms/WOc57C –  fboaventura Mar 8 '13 at 3:55
    
shouldn't it be telnet 1.1.1.1 1111 instead of telnet 10.0.0.1 1111? –  gnp Jul 10 '13 at 15:48
    
Also, I think you should be doing the source address translation on 2.2.2.2/32 instead of on the debian box, otherwise when 2.2.2.2 get's a reply it won't have an address to translate back to. –  gnp Jul 10 '13 at 15:55

1 Answer 1

You mentioned that some of the subnets overlap? If you are on one side of a VPN trying to reach something on the other side of the VPN with the same subnet, your workstation won't even send traffic to the router. You need to have different subnets at each end of a VPN to make sure your workstations send the traffic to the router.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.