I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (184.108.40.206/32 & 220.127.116.11/32)
On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.
I am also able to reach those services from both ends of the VPN - so 18.104.22.168/32 and 22.214.171.124/32.
Now I have few other subnets connected to the 126.96.36.199/32 box:
10.0.3.0/24 10.0.4.0/24 ....
(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 188.8.131.52 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 184.108.40.206 with source change. So I did that in the following way:
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 220.127.116.11 -j SNAT --to-source 18.104.22.168 iptables -t nat -A PREROUTING -p tcp -d 22.214.171.124 --dport 1111 -j DNAT --to-destination 126.96.36.199
But now, when I try to connect to that service, I am getting "No route to host" error:
telnet 10.0.0.1 1111 Trying 10.0.0.1... telnet: Unable to connect to remote host: No route to host
So I'm bit puzzled. I think the problem might be in the routing on the Debian box:
188.8.131.52 via 184.108.40.206 dev eth0 src 220.127.116.11
However, I am not quite sure why it does not work?
Routing from the Debian box:
10.0.0.0/27 dev eth1 proto kernel scope link src 10.0.0.1 10.0.2.0/24 via 10.0.0.2 dev eth1 10.0.3.0/24 via 10.0.0.3 dev eth1 10.0.4.0/24 via 10.0.0.4 dev eth1 10.0.5.0/24 via 10.0.0.5 dev eth1 10.0.6.0/24 via 10.0.0.6 dev eth1 10.0.7.0/24 via 10.0.0.7 dev eth1 18.104.22.168 via 22.214.171.124 dev eth0 src 126.96.36.199
Any ideas what can be wrong?