In a few days I'm going to be working on some field hardware, consisting of half a dozen Centos boxes networked together but not to the Internet. To do my work (in particular, to apply updates) I will need to temporarily connect these little networks to the Internet.

Most likely, my upwards connection will be through my Fedora laptop's wifi interface (and then onwards via a 4G modem). The general idea is to do NAT on my laptop, plug its ethernet interface into the field network with a suitable local IP, and temporarily set this as the default route on the field machines.

So far so good, but a complication arises from the fact that some of the updates will need to come from our company network (via a proprietary VPN client on my laptop) and some from the public Internet. The VPN server doesn't pass non-office traffic onwards to the Internet, clients are expected to only route "office" packets over the VPN and to send Internet traffic directly.

I'm not particularly expert with routing, iptables, etc. I've picked up these snippets of config which almost do the NAT I require:

iptables -A FORWARD -i $NAT_IF -j ACCEPT
iptables -A FORWARD -o $NAT_IF -j ACCEPT
iptables -t nat -A POSTROUTING -o $WAN_IF -j MASQUERADE

...where $NAT_IF is my laptop's ethernet port (the local side) and $WAN_IF is either the wifi interface or the ppp interface created by the VPN client. So with this I can let the client machines connect either to the Internet, or to the company office, but not both at once. This isn't very convenient when one dnf update command might need to pull both some public RPMs and some proprietary company ones.

Unfortunately I'm not in a position to try it right now, but maybe this is as simple as duplicating the last line above, with one using the VPN as $WAN_IF and one the wifi interface. However, I suspect not, because it doesn't seem to do anything to specify which packets need to go up the ppp interface (anything for and which direct to the wifi (everything else).

What do I need to do on my laptop (acting as router) to let machines on the local network talk to both the office and the Internet, with the distinction between the two very preferably being made on the laptop rather than having to do config on each client?

Thanks for your help.

  • Actually I think I might have just had a rubber-duck moment here. -d on the -o ppp0 rule, and ensuring that one comes before the -o wifi one, ought to do it, right? – Pete Verdon Jun 25 '17 at 23:23

To differentiate traffic route you need add routes

ip route add dev $VPN_IF


ip route add via $TUNNEL_REMOTE_IP

How to add it, depends on your vpn configuration.

For example: You can configure additional routes in NetworkManager GUI

And probably you need to masquerade for VPN same as for WAN

iptables -t nat -A POSTROUTING -o $VPN_IF -j MASQUERADE

If your company's VPN server knows nothing about your LAN subnet.

  • Thanks. I guess the VPN client is probably setting those routes for me; traffic originating in the laptop already goes where it should. It's traffic incoming on the ethernet interface which needs to go out, NATted, on the correct choice of VPN or wifi. So maybe all I need is the second MASQUERADE line. – Pete Jun 26 '17 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.