0

I have instance in cloud (alicloud - very similar to AWS) that need to establish IPVPN connection to a destination server. However, the dest VPN server limits the incoming IP to only 192.168.40.34. As such, we need to use NAT behind IPVPN. We can only connect to destination using that IP. I cannot use VPN gateway service provided by alicloud (or AWS) as it does not support IPVPN with NAT.

As such, I created an instance with public IP and configured strongswan which I manage to connect to the client VPN gateway successfully.

However I am unable to figure out how to get traffic routed properly from my network segment.

10.15.103.10 ---> 10.15.66.10 ---> internet ----> 1.2.3.4 -------------> 192.168.118.5      
(source)          (vpn server)                    (client vpn server)    (destination)

More information here:

my internal IP is 10.15.x.x range and destination is 192.168.118.x

strongswan configuration is successful and can connect to destination VPN

I used iptables with SNAT which allow me to connect into destination using 192.168.40.34.

I now need to connect to destination from 10.15.103.10 but somehow I can't figure out how to get vpn server (10.15.66.10) to route the traffic.

Here is my IPtables:

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  anywhere             192.168.118.0/24     to:192.168.40.34

telnet from vpn server:

[root@ ~]# telnet 192.168.118.245 5001
Trying 192.168.118.245...
Connected to 192.168.118.245.
Escape character is '^]'.
^]
telnet> quit
Connection closed.

telnet from source server:

[abubin@ ~]$ telnet 192.168.118.245 5001
Trying 192.168.118.245...
^C

I have seen a lot of tutorial showing this to be done using 2 NIC. However, in cloud environment you cannot have 2 NIC with different subnet.

Any advice is highly appreciated.

update: iptables-save

# Generated by iptables-save v1.4.21 on Tue Jun 16 13:26:19 2020
*nat
:PREROUTING ACCEPT [365948:21994532]
:INPUT ACCEPT [365948:21994532]
:OUTPUT ACCEPT [85145:6334345]
:POSTROUTING ACCEPT [85145:6334345]
COMMIT
# Completed on Tue Jun 16 13:26:19 2020
# Generated by iptables-save v1.4.21 on Tue Jun 16 13:26:19 2020
*filter
:INPUT ACCEPT [1802386:137299224]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1021209:343812526]
COMMIT
# Completed on Tue Jun 16 13:26:19 2020
6
  • Shouldn't really be a problem. Just try to figure out where your packets go (traffic counters and/or captures), are they natted, are they tunneled, do they reach the destination, is there a response etc.
    – ecdsa
    Jun 10, 2020 at 14:51
  • I did try tracking the connection from source server and it goes up to my vpn server. Somehow I can't figure out the iptable rules to make the routing works. I really am a noob in iptables. I have tried adding some postrouting rules following some guides but it doesn't work. Any idea?
    – abubin
    Jun 11, 2020 at 3:36
  • So there are no ESP packets sent (i.e. the packet counter on the outbound SA stays at 0)? Is IP forwarding enabled? Are there any firewall rules that might block the traffic (output of iptables-save could help)?
    – ecdsa
    Jun 11, 2020 at 11:23
  • I added the code into the above post as there problem with text formatting in this comments section.
    – abubin
    Jun 16, 2020 at 5:27
  • ipforwarding is enabled
    – abubin
    Jun 16, 2020 at 5:32

0

You must log in to answer this question.

Browse other questions tagged .