0

Here's an easy setup with a twist:

There is a Samba server running in the LAN on 192.168.1.88. VPN clients connect directly to the server, cannot see each other and are not routed into the LAN.

I want to redirect or forward:

  • All traffic incoming on the tun0 device (172.16.0.1) and Samba port (139) --> Samba server (192.168.1.88)
  • All response traffic from Samba server to the VPN server's LAN address (192.168.1.99) --> tun0 device (172.16.0.1) --> VPN client (172.16.0.8)

This is the NAT rule set I tried to achieve the redirect/forward tasks with:

iptables -t nat -I PREROUTING -i tun0 -d 172.16.0.1 -p tcp --dport 139 -j DNAT --to-destination 192.168.1.88:139
iptables -I FORWARD -o tun0 -d 192.168.1.88 -p tcp --dport 139 -j ACCEPT

Addresses in the network:

  • Internal VPN address: 172.16.0.1
  • VPN server LAN address: 192.168.1.99
  • Client address (example): 172.16.0.8
  • Samba server LAN address: 192.168.1.88

What's missing in the rules to send the VPN traffic on the right route?

Thanks in advance!

0

You should as well have the NAT on the other way:

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

In addition, the Samba server will receive a request from a client in the 172.16.0.0 network (I'm assuming it is /24), so it needs to know the route to it to answer to the request. So if you run ip route show on the Samba server, you should see a line indicating something like:

172.16.0.0/24 via 192.168.1.99

or, if no specific rule for 172.16.0.0:

default via 192.168.1.99

If you don't, you need to add the route as well with

ip route add 172.16.0.0/24 via 192.168.1.99

Another thing is that you will need to allow the IP forward in the VPN server for the Samba to reply:

sysctl -w net.ipv4.ip_forward=1

or

echo 1 > /proc/sys/net/ipv4/ip_forward

But watch out, because at that point you will have routes in both ways. The statement:

VPN clients connect directly to the server, cannot see each other and are not routed into the LAN.

will depend on the routes that you send to the VPN clients.

As long as you don't have any unlisted iptables rules that may be filtering it, it should work.

I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.