The situation in my environment is as follows:
There is a network (188.8.131.52/26) with a VPN gateway (184.108.40.206).
There is a distant network (10.42.0.16/28) on AWS which is connected with 220.127.116.11/26 through AWS VPC VPN which has a RADIUS server on 10.42.0.30.
I wish external clients to connect with 18.104.22.168/26 using the VPN gateway 22.214.171.124 authenticating through 10.42.0.30.
My problem is, that 126.96.36.199 does not reach 10.42.0.30 as it sends through the wrong interface. When I add
iptables -t nat -A POSTROUTING -s <address of the tunnel interface> -d 10.42.0.16/28 -j SNAT --to-source 188.8.131.52
I am able to ping 10.42.0.30, but the RADIUS packages are not transmitted through the tunnel.
How do I have to change the network configuration to allow the gateway (184.108.40.206) to connect to hosts in 10.42.0.16/28?
I am using strongswan as VPN server. Pinging with
-I 220.127.116.11 is successful without the iptables rule.
The routing table is as follows:
10.0.0.0/8 dev Tunnel1 scope link metric 100 10.0.0.0/8 dev Tunnel2 scope link metric 200 18.104.22.168/26 dev eno1 proto kernel scope link src 22.214.171.124 169.254.21.173 dev Tunnel1 proto kernel scope link src 169.254.21.174 169.254.21.233 dev Tunnel2 proto kernel scope link src 169.254.21.234
Modifying the routing table to:
10.0.0.0/8 dev Tunnel1 scope link metric 100 src 126.96.36.199 10.0.0.0/8 dev Tunnel2 scope link metric 200 src 188.8.131.52 184.108.40.206/26 dev eno1 proto kernel scope link src 220.127.116.11 169.254.21.173 dev Tunnel1 proto kernel scope link src 169.254.21.174 169.254.21.233 dev Tunnel2 proto kernel scope link src 169.254.21.234
allows the ping to go through without -I but
traceroute finds no route to host.
tracepath gets no replies.