I have instance in cloud (alicloud - very similar to AWS) that need to establish IPVPN connection to a destination server. However, the dest VPN server limits the incoming IP to only 192.168.40.34. As such, we need to use NAT behind IPVPN. We can only connect to destination using that IP. I cannot use VPN gateway service provided by alicloud (or AWS) as it does not support IPVPN with NAT.
As such, I created an instance with public IP and configured strongswan which I manage to connect to the client VPN gateway successfully.
However I am unable to figure out how to get traffic routed properly from my network segment.
10.15.103.10 ---> 10.15.66.10 ---> internet ----> 1.2.3.4 -------------> 192.168.118.5
(source) (vpn server) (client vpn server) (destination)
More information here:
my internal IP is 10.15.x.x range and destination is 192.168.118.x
strongswan configuration is successful and can connect to destination VPN
I used iptables with SNAT which allow me to connect into destination using 192.168.40.34.
I now need to connect to destination from 10.15.103.10 but somehow I can't figure out how to get vpn server (10.15.66.10) to route the traffic.
Here is my IPtables:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere 192.168.118.0/24 to:192.168.40.34
telnet from vpn server:
[root@ ~]# telnet 192.168.118.245 5001
Trying 192.168.118.245...
Connected to 192.168.118.245.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
telnet from source server:
[abubin@ ~]$ telnet 192.168.118.245 5001
Trying 192.168.118.245...
^C
I have seen a lot of tutorial showing this to be done using 2 NIC. However, in cloud environment you cannot have 2 NIC with different subnet.
Any advice is highly appreciated.
update: iptables-save
# Generated by iptables-save v1.4.21 on Tue Jun 16 13:26:19 2020
*nat
:PREROUTING ACCEPT [365948:21994532]
:INPUT ACCEPT [365948:21994532]
:OUTPUT ACCEPT [85145:6334345]
:POSTROUTING ACCEPT [85145:6334345]
COMMIT
# Completed on Tue Jun 16 13:26:19 2020
# Generated by iptables-save v1.4.21 on Tue Jun 16 13:26:19 2020
*filter
:INPUT ACCEPT [1802386:137299224]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1021209:343812526]
COMMIT
# Completed on Tue Jun 16 13:26:19 2020
iptables-save
could help)?