up vote 1 down vote favorite
1
share [g+] share [fb]

I set up a VPN ssh tunnel using between two Linux machines using these instructions.

Machine B acts as the server, and A as the client for the following.

I can ping from A and get replies from any computer in B's network, so everything seems to be working peachy. I can't however seem to get replies for DNS requests coming from A to a DNS server in B's network. I am guessing this is because UDP is stateless and only replies are permitted back?

  • Is this the case, or must something else be wrong?
  • If this is the case, how can I set up up a two way tunnel?
  • If I set up a two way tunnel, can I use iptables applied to the tun interface to only allow DNS back? Or maybe there is a better way to only allow DNS?
link|improve this question
76% accept rate
Try NMAP ​ – Brad Gilbert Aug 21 '09 at 19:17
Actually I take it back, I am not getting replies from machines on B's network except from B itself. The replies are getting back to B, but not the client on A. Can see the replies with tcpdump ... – Kyle Brandt♦ Aug 21 '09 at 19:29
feedback

2 Answers

up vote 1 down vote

The docs state "Once you have this running it is fairly easy to route traffic between two networks on each end of the VPN. See the first reference link below for details. "

Have a look at the routing section of https://help.ubuntu.com/community/SSH%5FVPN which gives how to add the routes.

Basically the traffic is rewrite on machine b and gets returned to it but it doesn't know about the network on the A side of things so drops the traffic.

link|improve this answer
Still doesn't seem to work for some reason. So for example, three machines, A, B, C. A is in the 'client' network of of the VPN tunnel. B and C are in the Server network, with B acting as the server. If I ping C, from A, I can see the replies on B going back to A with TCPDUMP, but A doesn't get them. Will try to update the post later this weekend. – Kyle Brandt♦ Aug 21 '09 at 20:23
Could you post the content of your routing tables on A and B? That should shed some light. – wolfgangsz Aug 22 '09 at 17:57
feedback
up vote 0 down vote accepted

Forwarding wasn't working correctly, I used:

sudo sysctl net.ipv4.conf.default.forwarding=1

Which didn't work, however when I use:

sudo sysctl net.ipv4.ip_forward=1

It does work, not sure what the difference in these two is exactly though...

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.