I have the following network setup:

                                        |                                   |
+------------------------+              |            Public Box             |
|       Client Box       |    IPSEC     |       public IP: x.x.x.x          |
|      +--------------+ source IP for IPSEC: |
+------------------------+              |                                   |

Client box has no publicly available IP address (it's hidden behind a NAT router which itself gets a 10.x.x.x/8 address from the internet provider (carrier grade NAT), but it has a permanently running IPSEC tunnel to the public box. I can communicate between the public box and the clientbox by their 192.x.x.x addresses. The public box is configured to use the IP address to communicate inside the IPSEC tunnel and is also reachable via this address from the Client Box and other boxes. The public IP address of the Public Box is not in the encryption domains (leftsubnet / rightsubnet) of the IPSEC configuration.

So far everything works perfectly. The goal is now to make one IP port (443) of the Client Box publicly available from the Internet, forwarding any connection directed to port 10443 of the public IP address of the Public Box to port 443 of the Client Box, through the IPSEC tunnel.

I have tried with the following rule (I have all policies on ACCEPT)

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 10443 -j DNAT --to

This didn't work. When trying to telnet to port 10443 of the Public Box, I get a "telnet: connect to address x.x.x.x: Network is unreachable"

The reason seems to be that the Public Box tries to look up the IP address via ARP, it doesn't put the connection into the IPSEC tunnel.

00:26:42.649885 IP > x.x.x.x.10443: Flags [S], seq 17484960, win 65535, options [mss 1412,nop,wscale 5,nop,nop,TS val 1133369435 ecr 0,sackOK,eol], length 0
00:26:42.650012 ARP, Request who-has tell x.x.x.x, length 28

I believe this is because the SOURCE address of this packet is the source address of the originator of the connection, so it will not be packed into the tunnel (the tunnel only routes <-->

So, my question is: is it possible to NAT the SOURCE address of the incoming packet to so it is routed through the IPSEC tunnel to the Client Box and any answer packet arrives at the Public Box again, in order to get "un-masqued" and sent back to the originator?

Is that possible at all?

  • "When trying to telnet to port 10443 of the Public Box": from where? – MadHatter Mar 16 '15 at 23:51
  • Let's see your routing tables. – Michael Hampton Mar 16 '15 at 23:53
  • I have tried to telnet port 10443 from another host that has internet connection, via the Internet. – Christian Anton Mar 17 '15 at 9:28
  • Routing tables on the "Public Box": gist.github.com/fibbs/d29ec21db3d5a540ea5e. The destination network doesn't appear there, because it's behind the ipsec tunnel – Christian Anton Mar 17 '15 at 9:29
  • I seem to be having the same problem. Did you manage to fix it? – Juliano May 16 '16 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.