IP forwarding not working on ppp-over-ssh vpn
I have a vpn (ppp-over-ssh) between our main office (192.168.0.0, nm 255.255.255.0) and a smaller one (192.168.2.0, nm 255.255.255.0). The vpn works perfect for the machine (192.168.2.10) that it is connected on, but I want the other machines (e.g.192.168.2.12) in the small office to have access to the main office's net.
The vpn-client-machine has the following ifconfig & routing table:
# cat /proc/sys/net/ipv4/ip_forward
The other machines at the small office are configured to route everything going to the main offiice via the vpn-client machine:
# traceroute 192.168.0.32
traceroute to 192.168.0.32 (192.168.0.32), 30 hops max, 40 byte packets
1 dgb10.dgbsweden (192.168.2.10) 0.595 ms 0.433 ms 0.484 ms
2 * * *
30 * * *
When I do the same from the vpn-machine, it works:
#traceroute to 192.168.0.32 (192.168.0.32), 30 hops max, 40 byte packets
1 192.168.207.1 52.422 ms 107.896 ms 104.974 ms
2 dgb32.dgb (192.168.0.32) 102.001 ms 99.144 ms 96.193 ms
I have no firewalls on the machines.
Does anyone have a clue what could be wrong?
I think the route on the vpn machine to the remote 192.168.0.0/24 network should point to the remote end of the ppp link, i.e. the correct gateway should be 192.168.207.1 (supposed that 192.168.207.1 is the IP of the remote end of the ppp link).
An other reason may be that the route to the local 192.168.2.0/24 network is missing at the remote end of the vpn link. (Thus your requests reach machines on the remote (192.168.0.0/24) network, but the replies are not routed back). Have you checked the routing table of the remote vpn machine?
192.168.0.0 192.168.2.10 255.255.0.0
192.168.0.0 192.168.2.10 255.255.255.0
However, I think there must be some other error, too, as the routing towards the remote 192.168.0.0/24 network is accidentally not affected by that netmask error: all packages sent from a local client to the remote, 192.168.0.0/24 network are still routed to the correct gateway (192.168.2.10), and all packages coming from the remote network are routed on the local gateway, where the routing table is free of this error, so those packages are correctly routed to the local clients, too.
So, I think this error cannot be the only reason why traceroute does not work.
However, I must admit that I am not a network guru, so I may be wrong.
|All times are GMT -5. The time now is 11:15 PM.|