I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (220.127.116.11/32 & 18.104.22.168/32)
On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.
I am also able to reach those services from both ends of the VPN - so 22.214.171.124/32 and 126.96.36.199/32.
Now I have few other subnets connected to the 188.8.131.52/32 box:
10.0.3.0/24 10.0.4.0/24 ....
(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 184.108.40.206 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 220.127.116.11 with source change. So I did that in the following way:
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 18.104.22.168 -j SNAT --to-source 22.214.171.124 iptables -t nat -A PREROUTING -p tcp -d 126.96.36.199 --dport 1111 -j DNAT --to-destination 188.8.131.52
But now, when I try to connect to that service, I am getting "No route to host" error:
telnet 10.0.0.1 1111 Trying 10.0.0.1... telnet: Unable to connect to remote host: No route to host
So I'm bit puzzled. I think the problem might be in the routing on the Debian box:
184.108.40.206 via 220.127.116.11 dev eth0 src 18.104.22.168
However, I am not quite sure why it does not work?
Routing from the Debian box:
10.0.0.0/27 dev eth1 proto kernel scope link src 10.0.0.1 10.0.2.0/24 via 10.0.0.2 dev eth1 10.0.3.0/24 via 10.0.0.3 dev eth1 10.0.4.0/24 via 10.0.0.4 dev eth1 10.0.5.0/24 via 10.0.0.5 dev eth1 10.0.6.0/24 via 10.0.0.6 dev eth1 10.0.7.0/24 via 10.0.0.7 dev eth1 22.214.171.124 via 126.96.36.199 dev eth0 src 188.8.131.52
Any ideas what can be wrong?