I have a server running Debian which has networking like this:
eth0 - has public IP address 126.96.36.199 eth1 - has public IP address 188.8.131.52
I'm trying to set up a VPN on the server which I can connect to from my Android phone. I followed the instructions at http://wiki.debian.org/HowTo/AndroidVPNServer to install and configure xl2tpd and racoon. It all works, but I have one last adjustment I want to make: when I connect my phone to the VPN, my public IP address out of which traffic from the phone is routed is the one on eth0, i.e. 184.108.40.206. I'd like VPN traffic to be NATed behind eth1's IP address, that is 220.127.116.11 (ideally, with VPN clients continuing to connect to 18.104.22.168).
My firewall rules look like this:
VPN_CLIENT_RANGE=192.168.200.0/24 iptables -A INPUT -p udp --dport 500 -j ACCEPT iptables -A INPUT -p udp --dport 4500 -j ACCEPT iptables -A INPUT -p esp -j ACCEPT iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT # Enable VPN traffic on the ppp+ adapters (only active when a call is established) # to go through the machine using SNAT/masquerading. iptables -A FORWARD -i ppp+ -o eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o ppp+ -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -s $VPN_CLIENT_RANGE -j MASQUERADE
I had hoped that changing eth0 to eth1 in the last three lines would achieve the right effect, but it does not - the VPN client can connect but can no longer see the internet, and the logs show traffic from VPN clients (pppX interfaces on the server) still being sent out of eth0 (which the firewall blocks without those last three lines).
Do I need to configure a source address in pppd somehow? Or change the default route for ppp interfaces?