-1

The configuration is as following:

    LAN 1                                     LAN 2
address is not                            192.168.0.0/24 
  important
                                          192.168.0.1/24
172.16.0.2/24  <-->  172.16.0.0/24  <-->  172.16.0.1/24
    client                LAN                 server
                        OpenVPN

So there is a gateway to 192.168.0.0/24 network, having the address 192.168.0.1. And there is a client connected via OpenVPN tunnel. The client should be able to access any server in 192.168.0.0/24 network as if it was in this network. I’ve added a rule in the iptables

iptables -t nat -A POSTROUTING -p tcp -s 172.16.0.0/24 \
         -d 192.168.0.0/24 -j SNAT --to-source 192.168.0.1

that should, in my opinion, translate the source IP address of any packets coming from the OpenVPN tunnel and having destination in the 192.168.0.0 network, to 192.168.0.1, the VPN server’s own internal IP in that network.

But when I try to mount a CIFS share over VPN, I see in the logs

Denied connection from 172.16.0.2 (172.16.0.2)
[2016/09/30 16:59:09.395655,  0] lib/access.c:338(allow_access)

So the source IP address is not translated. This CIFS server runs locally on the VPN server, may this be an issue?

2
  • You might not need to use a NAT (serverfault.com/questions/662542/…). – ysdx Sep 30 '16 at 14:31
  • @ysdx I know what you mean, but setting up NAT once properly is simpler, than adding the VPN subnet to configuration of all services that run in 192.168.0.0. – tijagi Sep 30 '16 at 14:37
1

POSTROUTING is only used for packets in transit, not for packets intended for the current host. You need to add your NAT rules to the INPUT chain as well if you need them as well for the packets intended to the current host.

See man iptables-extensions:

SNAT: This target is only valid in the nat table, in the POSTROUTING and INPUT chains

0

POSTROUTING only affects packets after routing. Because the destination is the router itself, no routing takes place, so POSTROUTING is not applied. You are probably looking for PREROUTING, which affects all packets before they are routed.

1
  • I thought as much, but if I change POSTROUTING to PREROUTING, it doesn’t help. – tijagi Sep 30 '16 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.