2

I have a bit of a tricky setup on my Synology NAS:

  1. There is a VPN tunnel up and running which also acts as default gateway (tun0, GW: 10.129.15.229). This is intended and should stay like this so that everything that is initiated on the NAS is going through the VPN.

  2. I now want to use NAT on my local network (initiated by other computers in the private net 192.168.2.0/24, using the local gateway 192.168.2.1).

Just switching on NAT using iptables rules like this modprobe iptable_nat iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to-source 192.168.2.20

Seems to interfere with the default GW named in 1 (nothing happens/does not work).

Any ideas how I can set this up? Can I mark the packages with iptables somehow and then set up a route to 192.168.2.1 explicitly for those marked packages?

Many thanks!

  • 1
    I have a feeling this should be asked in superuser, however my gut feel is that you should explicitly add the subnets on the other end of the VPN as routes and then change your default gateway to this new one. If that is too broad a solution then it looks like iptables can be used with cgroups to route per-process in kernel 3.14+: evolware.org/?p=369 – Alex Berry Jul 19 '17 at 14:19
1

It worked out like that:

iptables --append FORWARD --in-interface eth1 -j ACCEPT
iptables --append FORWARD --in-interface eth0 -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE

echo 10 vpn >> /etc/iproute2/rt_tables
ip rule add from 192.168.2.0/24 lookup vpn
ip route add default via 192.168.2.1 table vpn

192.168.2.1 is the local gateway I want to route through, 192.168.2.X my local net.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.