1

I want to create a VPN connection to another network, but we have to map our Addresses (172.16.0.0/22) to a new IP because the destination network is also using our IPs. So we tried to setup this connection with the NETMAP target. We want to access services in 3 networks at the destination: 1.1.0.0/17, 3.3.0.0/16, 5.5.0.0/16 (only an example!) Also it's not possible to map our network 1:1, but we have only one ip address accepted by the destination network (192.168.72.1). I have the following nat rules configured:

Chain eth0_in (1 references)
target     prot opt source               destination         
NETMAP     all  --  1.1.0.0/16        192.168.72.1        172.16.0.0/22
NETMAP     all  --  3.3.0.0/16        192.168.72.1        172.16.0.0/22
NETMAP     all  --  5.5.0.0/16        192.168.72.1        172.16.0.0/22

Chain eth0_masq (1 references)
target     prot opt source               destination         
MASQUERADE  all  --  172.16.0.0/16        anywhere            policy match dir out pol none 
SNAT       all  --  172.16.0.0/16        anywhere            policy match dir out pol none to:192.168.72.1 

Chain eth0_out (1 references)
target     prot opt source               destination         
NETMAP     all  --  172.16.0.0/22        1.1.0.0/16       192.168.72.1/32
NETMAP     all  --  172.16.0.0/22        3.3.0.0/16       192.168.72.1/32
NETMAP     all  --  172.16.0.0/22        5.5.0.0/16       192.168.72.1/32

This works partly. The first address accessed after a iptables reload works, but all other addresses aren't working. e.g

telnet 1.1.0.1 works
telnet 3.3.0.1 fails

-- reload all iptables

telnet 3.3.0.1 works
telnet 1.1.0.1 fails

What is wrong? Is it possible to map a network to one IP for multiple destinations?

1 Answer 1

0

There was some unwanted interaction with an ipsec tunnel also configured on the system. After disabling it, the netmap worked perfectly as intended. After some inspection we found the error in the policy level, which was set to required instead of unique. Enabling the ipsec tunnel again with "unique" solved the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .