0

I tried to setup a new gateway in my virtual network, but I'm sure I have a problem. The gateway cannot ping the client but the client can ping other clients and the gateway. I have checked my iptables rules (I don't see a problem).

Current iptables rules:

iptables -t nat -A POSTROUTING -s $VPN_SUBNET -o $NET_INTERFACE -j MASQUERADE
 -> Allow VPN Interface to access the whole world, back and forth.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s $VPN_SUBNET -m state --state NEW -j ACCEPT
iptables -A OUTPUT -s $VPN_SUBNET -m state --state NEW -j ACCEPT
iptables -A FORWARD -s $VPN_SUBNET -m state --state NEW -j ACCEPT

Current route (xxx.xxx.xxx.xxx is the public IP):

default via xxx.xxx.xxx.xxx dev eth0
xxx.xxx.xxx.xxx dev eth0  scope link
192.168.7.0/24 dev tap_soft  proto kernel  scope link  src 192.168.7.1

When I ping a client from the gateway, I see this from tcpdump:

IP xxx.xxx.xxx.xxx > 192.168.7.85: ICMP echo request, id 12176, seq 1, length 64

And no response back.

The problem is the same with all protocols like TCP, UDP, ICMP.

1 Answer 1

0

There is no rule that allows incoming traffic from your gateway, it only allows traffic when it is already established or related. If you want to only allow ping from the gateway you can use something like this:

iptables -A INPUT -s <GATEWAY-IP> -i <PUBLIC-INTERFACE> -d <PUBLIC-IP of the client> --icmp-type ping -j ACCEPT
3
  • thanks for your reply, but if i understand correctly this iptable cmd the packet from gateway to client pass clearly over internet. And this affect all traffic not only icmp
    – McKay1717
    Jul 20, 2015 at 10:14
  • Your routing table show that the communication from your client to the gateway is using eth0, which I assume is the public interface. So that is where you need the rule to apply. The -s flag in the iptables limits the ping to only the IP of the gateway, so only it can ping your client, not the whole world. Also the rule only matches for ICMP ping packets, what happens to other packets on the interface depends on the configuration of the chain which I can't see in your question.
    – dadriel
    Jul 20, 2015 at 10:31
  • Okay but client to client work correctly and pass through the gateway
    – McKay1717
    Jul 20, 2015 at 12:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .