2

I have two remote servers that have their local LAN connected via a VPN. Some more details including routing tables here https://ghostbin.com/paste/6sv3w

192.168.1.1 is router1 with lan 192.168.1.0/24 and VPN IP address 10.10.10.1 192.168.200.1 is router2 with lan 192.168.200.0/24 and VPN address 10.10.10.2

How to make 192.168.1.0/24 accessible from 192.168.200.0/24 without masquerading NAT? If I use NAT and add masquerade I loose source client IP and when I try to make a request from 192.168.200.0/24 everything receives 10.10.10.2 as IP address.

My goal is to preserve the client IP address when connecting through the VPN.

Thanks!

Edit:

Adding ghostbin content.

192.168.1.1 is a DMZ host that gets internet from 192.168.1.11

router1 - 192.168.1.0/24, vpn 10.10.10.1

routing table
-------------
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.11    0.0.0.0         UG    3      0        0 eth0
10.10.10.0      10.10.10.2      255.255.255.0   UG    0      0        0 tun0
10.10.10.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.200.0   10.10.10.2      255.255.255.0   UG    0      0        0 tun0


router2 is a remote server connected to router1 via OpenVPN

router2 - 192.168.200.0/24, vpn 10.10.10.2

routing table
-------------
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         79.124.31.17    0.0.0.0         UG    0      0        0 eth0
10.10.10.0      10.10.10.1      255.255.255.0   UG    0      0        0 tun0
10.10.10.1      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
79.124.31.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
79.124.31.16    0.0.0.0         255.255.255.240 U     0      0        0 eth0
192.168.1.0     10.10.10.1      255.255.255.0   UG    0      0        0 tun0
192.168.200.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1
5
  • 1
    Please include the content of your ghostbin here. – EEAA Dec 7 '15 at 14:32
  • Added content from ghostbin. – Radoslav Stefanov Dec 7 '15 at 15:07
  • please, show a routing table of any host in 192.168.1.0/24 network. In partucular, I want to see what is default gateway there. – Nikita Kipriyanov Dec 7 '15 at 15:11
  • Hi @NikitaKipriyanov, The default GW for hosts in 192.168.1.0/24 is 192.168.1.1: vm-nfs ~ # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 3 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 – Radoslav Stefanov Dec 7 '15 at 16:02
  • I stand corrected: Hosts behind the VPN receive 10.10.10.2 as source IP. – Radoslav Stefanov Dec 7 '15 at 16:08
1

Your network schema is like this:

                            192.168.1.1        10.10.10.1 
{hosts in 192.168.1.0/24}-----[eth0    router1    tun0]
                                                    |
                                                    |
{hosts in 192.168.200.0/24}---[eth1    router2    tun0]
                           192.168.200.x       10.10.10.2

(In general, it is better to draw schema by yourself when you ask anything about routing.)

router1 and router2 seem to have all required routes to forward packets from one network to another.

Hosts behind them have them as their default gateways, i.e. hosts in 192.168.1.0/24 have default gw router1 (192.168.1.1), and hosts in 192.168.200.0/24 have default gw router2 (192.168.200.x), you didn't say which exactly address it have.

So it probably could be only firewalls in router1 and router2. Probably you could test that with traceroute: take any host in 192.168.1.0/24 and trace any host in 192.168.200.0/24; and vice versa.

Try to enable forward traffic from eth0 to tun0 and back in router1 and traffic from eth1 to tun0 and back in router2.

4
  • This seems to be doing what I want: iptables -t nat -A POSTROUTING -s 10.10.10.2 -p tcp -j SNAT --to 192.168.200.8 However I don't want to write rules for each host on 192.168.200.0/24. Can I apply similar rule for the whole subnet? – Radoslav Stefanov Dec 7 '15 at 17:43
  • BTW @Nikita, thank you for the tip about network schema. – Radoslav Stefanov Dec 7 '15 at 17:49
  • Update: Apparently this was a firewall issue on router2 (I had MASQUERADE on for the VPN interface). – Radoslav Stefanov Dec 7 '15 at 20:54
  • Sometimes I think NAT makes more problems than solves. – Nikita Kipriyanov Dec 7 '15 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.