0

Currently I'm looking to learn about using GRE Tunnels and I have the following scheme:

Server1 (200.1.2.3) ----> Server2 (190.1.2.3)

Both servers have public IPs

Then I've setup a GRE Tunnel with the following commands I've found on internet

On Server1:

iptunnel add tunX mode gre remote 190.1.2.3  local 200.1.2.3 ttl 225
ifconfig tunX 10.0.201.1/24
ifconfig tunX up
ifconfig tunX pointopoint 10.0.201.2
ifconfig tunX multicast

On Server2:

iptunnel add tunY mode gre remote 200.1.2.3  local 190.1.2.3 ttl 225
ifconfig tunY 10.0.201.2/24
ifconfig tunY up
ifconfig tunY pointopoint 10.0.201.1
ifconfig tunY multicast

then I'm able to ping each machine by using their local addresses (10.0.201.1 for Server1 and 10.0.201.2 for Server 2).

Now I want a program running in Server1 to listen on port 5050 (tcp,udp) and be able to access that port from outside by connecting to 190.1.2.3:5050

Server1 should be able to listen ports through the public IP (200.1.2.3) as well (not the same as the one that I want to tunnel through GRE)

I've tried some iptables rules being applied in Server2 to forward traffic but they don't seem to work, so I think i'm missing something important in this setup to make it work.

Clients from internet should be able to connect to 190.1.2.3:5050 to access the service on Server1, but they should never know Server1 Public IP

A quick paint scheme would be like this: network scheme

Thanks

3
  • Did you NAT the source of the client to 10.0.201.2 in order for the routing to work properly?
    – lacasitos
    May 29, 2014 at 7:11
  • @lacasitos i'm not sure about what you exactly mean, I only achieved to do ping between the servers. I Tried DNAT on server2 to redirect incoming packets on port 500 to 10.0.201.1:500 but it didn't work so I think i must be doing it absolutely wrong
    – Rodrigo
    May 29, 2014 at 7:19
  • First of all you could check if the incoming packets reach server1. I assume "tcpdump -i tunY" would work to check this. But what I'm saying is that you have to change also the source IP of the packets during the NAT on server2 or else server1 will try to send the response packets through its default gateway with source IP 10.0.201.1 and not over the tunnel
    – lacasitos
    May 29, 2014 at 7:31

0

You must log in to answer this question.

Browse other questions tagged .