I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (18.104.22.168/32 & 22.214.171.124/32)
On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.
I am also able to reach those services from both ends of the VPN - so 126.96.36.199/32 and 188.8.131.52/32.
Now I have few other subnets connected to the 184.108.40.206/32 box:
10.0.3.0/24 10.0.4.0/24 ....
(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 220.127.116.11 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 18.104.22.168 with source change. So I did that in the following way:
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 22.214.171.124 -j SNAT --to-source 126.96.36.199 iptables -t nat -A PREROUTING -p tcp -d 188.8.131.52 --dport 1111 -j DNAT --to-destination 184.108.40.206
But now, when I try to connect to that service, I am getting "No route to host" error:
telnet 10.0.0.1 1111 Trying 10.0.0.1... telnet: Unable to connect to remote host: No route to host
So I'm bit puzzled. I think the problem might be in the routing on the Debian box:
220.127.116.11 via 18.104.22.168 dev eth0 src 22.214.171.124
However, I am not quite sure why it does not work?
Routing from the Debian box:
10.0.0.0/27 dev eth1 proto kernel scope link src 10.0.0.1 10.0.2.0/24 via 10.0.0.2 dev eth1 10.0.3.0/24 via 10.0.0.3 dev eth1 10.0.4.0/24 via 10.0.0.4 dev eth1 10.0.5.0/24 via 10.0.0.5 dev eth1 10.0.6.0/24 via 10.0.0.6 dev eth1 10.0.7.0/24 via 10.0.0.7 dev eth1 126.96.36.199 via 188.8.131.52 dev eth0 src 184.108.40.206
Any ideas what can be wrong?