I'm trying to route some traffic through a VPN network via tailscale rather than direct connection to the host. My setup is:
- Ubuntu Client with tailscale VPN (Now called C)
- Ubuntu Server with tailscale VPN in AWS (Now called S)
- MongoDB Atlas cluster in AWS, currently using public IP, later paired to Server with tailscale VPN in AWS (Now called A)
My goal is that C -> A uses the VPN via S.
I tried the following:
- Set up three host routes from C to the tailscale endpoint on S.
- Use MASQUERADE in nat POSTROUTING to connect from S to A.
Unfortunately the first point is already failing for me. I have tried to log the traffic on S in PREROUTING nat table via
LOG all -- anywhere anywhere LOG level warning
but I see no traffic going to A at all.
On C and S the ipv4 forwarding is on:
cat /proc/sys/net/ipv4/ip_forward 1
As I don't see any requests for IP Addresses in A (Atlas) on S, I think the traffic is never sent to S or swallowed there in one of the many tailscale rules. Any suggestions?