I am setting up the following network, there are three systems and the VPN is supposed to intermediate between the Firewall and the Kali. Lets assume that all the systems are using Ubuntu 16.04 (eventually I will install the Kali tools on Ubuntu):

My network

  • My Kali is able to reach the VPN Server, but it is not able to ping the Firewall.
  • I saw an ARP request to the VPN server asking for the Firewall, but there is no reply.
  • I would like to use NAT in the VPN server.
  • Edited: It seems that the Firewall is able to establish a new session with the Kali system, but it does not work in the other way. It is strange, since all the Iptables policies are ACCEPT by default.


  • Why there is no reply from the VPN when asked about the ARP address fo the Firewall? I was expecting the Firewall to reply with its own MAC address.
  • What else should I do to enable NAT in the VPN server?



Iptables for the VPN Server:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i enp0s3 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE # Enmascarmiento IP

iptables -A FORWARD -i tap0 -o enp0s3 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i enp0s3 -o tap0 -j ACCEPT

The Iptables for the other two systems have a policy of ACCEPT ALL.

Forwarding & Masquerade

Forwarding is enabled for the VPN Server. I already have the settings in /proc/sys/net/ipv4/ip_forward.

Also, the system have the module to use masquerada (lsmod):

ipt_MASQUERADE         16384  1
nf_nat_masquerade_ipv4    16384  1 ipt_MASQUERADE
nf_nat                 24576  2 nf_nat_ipv4,nf_nat_masquerade_ipv4
nf_conntrack          106496  5 nf_nat,nf_nat_ipv4,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4
x_tables               36864  5 ip_tables,ipt_MASQUERADE,xt_conntrack,iptable_filter,iptable_mangle



I found the bug: * U 0 0 0 tap0

The problem was that I was setting a default gateway for this route in the Kali system. I had to specify to output all the traffic through, which in my opinion is redundant, since it was the only possible way to go.


You don't allow new connections to be forwarded or accepted on your VPN server. Change

iptables -A FORWARD -i tap0 -o enp0s3 -m state --state RELATED,ESTABLISHED -j ACCEPT


iptables -A FORWARD -i tap0 -o enp0s3 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

and try if it works. If it does, remove the NEW statement for the general rule and create a new rule only forward and accept for those protocols/ports you need to forward, e. g.:

iptables -A FORWARD -i tap0 -o enp0s3 -p tcp --dport 22 -m state --state NEW -j ACCEPT

Also you have to use destination NAT if you want to forward an external request to your internal LAN:

Example: Forward SSH on port 10022 to an internal machine port 22:

iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -p tcp --dport 10022 -j MASQUERADE 

Also, did you set the forwarding rule permanently in /etc/sysctl.conf? If you just do echo 1 > /proc/sys/net/ipv4/ip_forward it's only active until next reboot.

EDIT: I just found out that I'm blind. Of course your firewall doesn't reply to your ARP request, it is in another network. ARP-requests don't get forwarded per definition. If your Laptop want's to communicate with the firewall it doesn't communicate directly but over the gateway (your VPN). In it's routing table the VPN is present as gateway for communication with the firewall so it shouldn't send an ARP request to the firewall at all. ARP is not IP, it doesn't get forwarded.

You should test if NAT works with SSH, try what I posted before and connect to your router over port 10022, you should get forwarded to your firewall.

  • IP Forwarding was enabled permanently. Thereare some good news, I have noticed that Firewall can ping the external one, so it is half of the work done. I don't know what happens, anyways, because since the policy is ACCEPT by default for all the chains, I expected to not find an unidirectional problem. By the way, I have checked if masquerade was enabled with lsmod. Let me update the main post. – Cod1ngFree Sep 22 '16 at 14:49
  • I updated my answer, your firewall shouldn't reply to ARP from the laptop, it's in another network. Also your ARP-request cant be forwarded, it's not IP. In fact, your laptop shouldn't even do an ARP request since it knows by its routing table that the firewall isn't in its own local network and should instead communicate with the firewall over the gateway. – Broco Sep 22 '16 at 15:01
  • You are right, but as far as I know, the VPN should reply to the ARP by setting its own physical address. Is it like that? If it is right, that's why I considered that a problem too. Anyways, I tried also other alternatives to ping already: pastebin.com/aHUqCWmS – Cod1ngFree Sep 22 '16 at 15:28
  • No. You ask for the IP of the firewall, why should VPN reply to that? Unless used for man in the middle attacks computers only reply to an ARP request if asked for their own IP, not for a routing target. If you communicate with the firewall from your laptop you don't directly communicate with it. You send packets to VPN and VPN forwards them to the firewall. So your laptop only needs to know the MAC of the VPN, and the VPN needs to know the MAC of the firewall, laptop and firewall don't need each others MAC. Remember, MAC is layer 2, IP is layer 3 = routing is layer 3. ARP doesn't get routed. – Broco Sep 22 '16 at 15:39
  • @Cod1ngFree Just a quck addition: Never set policy accept for all chains, better use drop and allow exactly what you need. Also communication between local interface (some processes use lo for communication). iptables -A INPUT -i lo -j ACCEPT and iptables -A OUTPUT -o lo -j ACCEPT – Broco Sep 22 '16 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.