Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN ( &

On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.

I am also able to reach those services from both ends of the VPN - so and

Now I have few other subnets connected to the box:

(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box port 1111. So I thought, I will use iptables once again and forward all tcp traffic to with source change. So I did that in the following way:

iptables -t nat -A POSTROUTING -s -d -j SNAT --to-source
iptables -t nat -A PREROUTING -p tcp -d --dport 1111 -j DNAT --to-destination

But now, when I try to connect to that service, I am getting "No route to host" error:

telnet 1111
telnet: Unable to connect to remote host: No route to host

So I'm bit puzzled. I think the problem might be in the routing on the Debian box: via dev eth0  src

However, I am not quite sure why it does not work?

Routing from the Debian box: dev eth1  proto kernel  scope link  src via dev eth1 via dev eth1 via dev eth1 via dev eth1 via dev eth1 via dev eth1 via dev eth0  src

Any ideas what can be wrong?

share|improve this question
I was trying to draw you network, but I wasn't able to... can you please be a little more specific of which net are behind which interface of which machine? Do you have two VPN machines, right? Both Debian? This was as far as I could get: – fboaventura Mar 8 '13 at 3:55
shouldn't it be telnet 1111 instead of telnet 1111? – GnP Jul 10 '13 at 15:48
Also, I think you should be doing the source address translation on instead of on the debian box, otherwise when get's a reply it won't have an address to translate back to. – GnP Jul 10 '13 at 15:55
Is there any way to only do the NATing at one site? – anders Apr 8 '15 at 15:36

You mentioned that some of the subnets overlap? If you are on one side of a VPN trying to reach something on the other side of the VPN with the same subnet, your workstation won't even send traffic to the router. You need to have different subnets at each end of a VPN to make sure your workstations send the traffic to the router.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.