Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Site to Site VPN on Debian box which is setup by rackoon. It works fine, however because subnetworks overlap NAT is used on both ends of the VPN (1.1.1.1/32 & 2.2.2.2/32)

On both subnets I have services that I want to share, so I've iptables forwarding those ports for me to the internal server, which works fine.

I am also able to reach those services from both ends of the VPN - so 1.1.1.1/32 and 2.2.2.2/32.

Now I have few other subnets connected to the 2.2.2.2/32 box:

10.0.3.0/24
10.0.4.0/24
.... 

(full routing table attached at the end)
and for computers within those networks I need to reach one service - on the box 1.1.1.1 port 1111. So I thought, I will use iptables once again and forward all tcp traffic to 1.1.1.1 with source change. So I did that in the following way:

iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 1.1.1.1 -j SNAT --to-source 2.2.2.2
iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 1111 -j DNAT --to-destination 1.1.1.1

But now, when I try to connect to that service, I am getting "No route to host" error:

telnet 10.0.0.1 1111
Trying 10.0.0.1...
telnet: Unable to connect to remote host: No route to host

So I'm bit puzzled. I think the problem might be in the routing on the Debian box:

2.2.2.2 via 1.1.1.1 dev eth0  src 1.1.1.1

However, I am not quite sure why it does not work?

Routing from the Debian box:

10.0.0.0/27 dev eth1  proto kernel  scope link  src 10.0.0.1
10.0.2.0/24 via 10.0.0.2 dev eth1
10.0.3.0/24 via 10.0.0.3 dev eth1
10.0.4.0/24 via 10.0.0.4 dev eth1
10.0.5.0/24 via 10.0.0.5 dev eth1
10.0.6.0/24 via 10.0.0.6 dev eth1
10.0.7.0/24 via 10.0.0.7 dev eth1
1.1.1.1 via 2.2.2.2 dev eth0  src 2.2.2.2

Any ideas what can be wrong?

share|improve this question
1  
I was trying to draw you network, but I wasn't able to... can you please be a little more specific of which net are behind which interface of which machine? Do you have two VPN machines, right? Both Debian? This was as far as I could get: sdrv.ms/WOc57C –  fboaventura Mar 8 '13 at 3:55
    
shouldn't it be telnet 1.1.1.1 1111 instead of telnet 10.0.0.1 1111? –  gnp Jul 10 '13 at 15:48
    
Also, I think you should be doing the source address translation on 2.2.2.2/32 instead of on the debian box, otherwise when 2.2.2.2 get's a reply it won't have an address to translate back to. –  gnp Jul 10 '13 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.