-1

I have a linux server running Centos7 that uses a VPN to route to a public IP homed in a remote network. I want to NAT from an IP address on that remote network to a local subnet over a VPN connection using PPP devices. When my tunnels come up, I can ping the 203.0.113.5 IP address from the public internet, but I can not seem to get the NAT statements to work correctly.

Map:

203.0.113.1              ROUTER TO INTERNET
  |
  |eth0                  VPN Server Public Interface
-----------------------
|VPN Server           |
-----------------------
203.0.113.2              VPN Public IP
  ||ppp0                 Tunnel Virtual Device
  ||10.0.0.1/24          Tunnel Gateway IP
  ||
  ||
  ||10.0.0.10/24         Tunnel Client IP
  ||ppp0                 Tunnel Client Device
198.51.100.129                  Broadband Public IP
   |eth0                 Public Interface
-----------------------
|THIS SERVER          |  
-----------------------
eth1|         |eth2
203.0.113.5/32   192.168.1.1/24

203.0.113.5 is a public IP. 192.168.1.1/24 is the private network. The VPN comes up with 10.0.0.0/24 network, and routing 203.0.113.5 via the Tunnel Client IP (and 203.0.113.0/30 via 10.0.0.1, default via 203.0.113.1) lets me ping 10.0.1.5 from the public internet. That is working, and I have confirmed it is THIS SERVER that is responding. I want to nat out the VPN, using the public IP 203.0.113.5. This doesn't seem, to work. I have tried the following NAT statements:

  iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -o ppp0 -j MASQUERADE --to-source 203.0.113.5
  iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -o ppp0 -j SNAT --to-source 203.0.113.5

I do not see and communication, I can not perform a name lookup, or a ping from machines in the 192.168.1.1 network.

Any advice would be appreciated

4
  • "1.0.1.1 is a public IP", but 1.0.1.1 is never mentioned elsewhere in your question. What is the purpose of 1.0.1.5/32 of eth1?
    – RalfFriedl
    Aug 7, 2018 at 18:41
  • Sorry, 1.0.1.5 is a public IP Aug 7, 2018 at 18:42
  • 1
    Don't use other people's IP addresses as examples for your network. This is confusing. Use IP address ranges reserved for the purpose instead. Aug 7, 2018 at 18:42
  • Edits made to obfuscate per documentation provided by Michael Hampton Aug 7, 2018 at 18:47

1 Answer 1

0

MASQUERADE normally doesn't need --to-source, because it is often used in dynamic context where the address of the interface might change.

Your source address should be the address of the VPN interface, 10.0.0.10, or in other words, the address of the interface of the -o argument, here ppp0. As that address is not public, you also need a NAT at the VPN Server. You can also do NAT only at the VPN Server and omit the NAT at "THIS SERVER".

What is the purpose of 203.0.113.5/32 on eth1? A /32 address on an Ethernet interface will not work with the card, you need at least /30. Is this address supposed to be directly reachable from the internet, or is this address reachable through the router at 203.0.113.1 and the VPN tunnel? If so, it would make more sense to add this address to the ppp0 interface.

1
  • On a Cisco ASA, I can write a NAT with the interface as the translated address, or my own: object network MericaLAN nat (inside,outside) dynamic 203.0.113.5 Aug 7, 2018 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .