I have a bit of a tricky setup on my Synology NAS:

  1. There is a VPN tunnel up and running which also acts as default gateway (tun0, GW: This is intended and should stay like this so that everything that is initiated on the NAS is going through the VPN.

  2. I now want to use NAT on my local network (initiated by other computers in the private net, using the local gateway

Just switching on NAT using iptables rules like this modprobe iptable_nat iptables -t nat -A POSTROUTING -s -j SNAT --to-source

Seems to interfere with the default GW named in 1 (nothing happens/does not work).

Any ideas how I can set this up? Can I mark the packages with iptables somehow and then set up a route to explicitly for those marked packages?

Many thanks!

  • 1
    I have a feeling this should be asked in superuser, however my gut feel is that you should explicitly add the subnets on the other end of the VPN as routes and then change your default gateway to this new one. If that is too broad a solution then it looks like iptables can be used with cgroups to route per-process in kernel 3.14+: evolware.org/?p=369 – Alex Berry Jul 19 '17 at 14:19

It worked out like that:

iptables --append FORWARD --in-interface eth1 -j ACCEPT
iptables --append FORWARD --in-interface eth0 -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE

echo 10 vpn >> /etc/iproute2/rt_tables
ip rule add from lookup vpn
ip route add default via table vpn is the local gateway I want to route through, 192.168.2.X my local net.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.