I am setting up the following network, there are three systems and the VPN is supposed to intermediate between the Firewall and the Kali. Lets assume that all the systems are using Ubuntu 16.04 (eventually I will install the Kali tools on Ubuntu):
- My Kali is able to reach the VPN Server, but it is not able to ping the Firewall.
- I saw an ARP request to the VPN server asking for the Firewall, but there is no reply.
- I would like to use NAT in the VPN server.
- Edited: It seems that the Firewall is able to establish a new session with the Kali system, but it does not work in the other way. It is strange, since all the Iptables policies are ACCEPT by default.
- Why there is no reply from the VPN when asked about the ARP address fo the Firewall? I was expecting the Firewall to reply with its own MAC address.
- What else should I do to enable NAT in the VPN server?
- Kali: http://pastebin.com/bWhasRwv
- VPN Server: http://pastebin.com/9FYSkV2R
- Firewall: http://paste.ubuntu.com/23215621/
Iptables for the VPN Server:
iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i tap0 -j ACCEPT iptables -A INPUT -i enp0s3 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE # Enmascarmiento IP iptables -A FORWARD -i tap0 -o enp0s3 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i enp0s3 -o tap0 -j ACCEPT
The Iptables for the other two systems have a policy of ACCEPT ALL.
Forwarding & Masquerade
Forwarding is enabled for the VPN Server. I already have the settings in /proc/sys/net/ipv4/ip_forward.
Also, the system have the module to use masquerada (lsmod):
ipt_MASQUERADE 16384 1 nf_nat_masquerade_ipv4 16384 1 ipt_MASQUERADE nf_nat 24576 2 nf_nat_ipv4,nf_nat_masquerade_ipv4 nf_conntrack 106496 5 nf_nat,nf_nat_ipv4,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4 x_tables 36864 5 ip_tables,ipt_MASQUERADE,xt_conntrack,iptable_filter,iptable_mangle
- VPN Server: http://pastebin.com/E4dVuvq0
- Kali: http://pastebin.com/9aXa4R3g
- Firewall: http://paste.ubuntu.com/23215645/
I found the bug:
184.108.40.206 * 255.255.255.0 U 0 0 0 tap0
The problem was that I was setting a default gateway for this route in the Kali system. I had to specify to output all the traffic through 10.8.0.1, which in my opinion is redundant, since it was the only possible way to go.