I currently have a VPN site-to-site setup where a Centos7 Server is set up as a VPN client to the tunnel at a remote site. The tunnel is established fine and I am trying to access resources at the remote site through the tunnel, but so far I cannot ping anything besides the VPN client itself, nothing behind it.
The remote site VPN client (centos7 server) can ping and access resources but clients behind the VPN client firewall cannot.
MAIN SITE: Router/Firewall: 192.168.150.1 (running openvpn/sophos firewall)
CLIENT SITE: Centos7 Server 192.168.200.1 (eth0 address) / 192.168.201.1 (tun0 address)
A client at the main site (say 192.168.150.2) can ping 192.168.200.1 and 192.168.201.2. but not 192.168.200.50 (a resource at the client site).
On the client site I have the following direct rules in place in firewalld:
ipv4 filter FORWARD 0 -i tun0 -o eth0 -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ipv4 filter FORWARD 0 -i eth0 -o tun0 -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
ipv4 forwarding has been enabled in the kernel. Each interface is in its own zone in firewalld.
Adding THIS RULE fixes the problem, and connectivity is established. But WHY? I don't want anything NAT'd.
ipv4 nat POSTROUTING 0 -o eth0 -j MASQUERADE