My boss got extra-paranoid and wants me to organize VPN-chaining of some sort for him. I come up with following scheme:
Client VPN1 VPN2 10.0.1.x[tun0]------10.0.1.1[tun0] [18.104.22.168][eth0] 10.0.2.x[tun1]----------10.0.2.1[tun0] 22.214.171.124[eth0] 126.96.36.199[eth0]------internet
I can use VPN1 from Client through iptables forwarding, like this:
vpn1 # iptables -A FORWARD -s 10.0.1.0/24 -j ACCEPT vpn1 # iptables -A FORWARD -d 10.0.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT vpn1 # iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j SNAT --to-source 188.8.131.52
I can use VPN2 from VPN1 if I make it default gateway, or if I select specified hosts, like this:
vpn1 # route add -host 184.108.40.206 dev tun1
What I can't use is full chain VPN1-VPN2-Internet from Client. I tried forwarding traffic from tun0 to tun1 and vice versa like this:
vpn1 # iptables -A FORWARD -i tun0 -o tun1 -j ACCEPT vpn1 # iptables -A FORWARD -i tun1 -o tun0 -j ACCEPT
In this case I can see ICMP requests going off from client IP on both VPN1 tun interfaces, but can't get any response.
How can I forward all traffic from Client through full chain?
edit: (all on vpn1)
tcpdump -i tun0 icmp shows requests with 10.0.1.6(Client) going to internet
tcpdump -i tun1 shows nothing
tcpdump -i eth0 shows same as tun0, 10.0.1.6(Client) sending request
My thought was iptables rules should forward tun0 to tun1 and vice versa, but for some reason traffic from tun0 gets to eth0 and then off to internet, could it be the problem?