LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   IPTables unable to nat trough VPN traffic (https://www.linuxquestions.org/questions/linux-networking-3/iptables-unable-to-nat-trough-vpn-traffic-942073/)

cygnusx 04-27-2012 07:05 AM

IPTables unable to nat trough VPN traffic
 
Hello,

I have a VPN connection to a server on a remote location. I want other pc's to be able to reach the webserver on the remote location trough the VPN connector. But i can't get where i want.

This is the situation:

Code:

VPN Server (and also the webserver): 10.0.0.2
          ^
          |
Router: 192.168.1.127 & 10.0.0.1 (openssh port is forwarded to 10.0.0.2)
          ^
          |
          |
VPN Connector: 192.168.1.148
          ^
          |
Client pc: 192.168.1.129


Also the ip of the vpn networks (called tun0) are:
VPN Server: 192.168.2.1
VPN Connector: 192.168.2.6

So, if i login to the VPN Connector, and do a wget 192.168.2.1:4848 it works fine.

That's good, the vpn connection works.

But what i want to do is: on the client pc go to the browser and go to 192.168.1.148:4848. (that's the vpn connector). Then the connector should forward it to the vpn showing me the webserver on 192.168.2.1 (the vpn server).

This is my IPTables setup:
Code:

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.148 --dport 4848 -m state --state NEW,ESTABLISHED,RELATED -j DNAT -to 192.168.2.1:4848
iptables -t nat -A POSTROUTING -o tun0 MASQUERADE

So, i'm fairly new to iptables, What am i missing?

If i do a tcpdump on the vpn connector on tun0 i can see that the packets go trough?

Code:

13:31:02.850057 IP 192.168.1.129.52870 > 192.168.2.1.1337: Flags [S], seq 538959383, win 8192, options                          [mss 1460,nop,nop,sackOK], length 0
But if i do a tcpdump on the VPN server on tun0 nothing is happening.

I'm sorry that this is a long post, but what am i doing wrong? Please help!

nikmit 04-27-2012 10:11 AM

I would replace
Code:

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.148 --dport 4848 -m state --state NEW,ESTABLISHED,RELATED -j DNAT -to 192.168.2.1:4848
with
Code:

iptables -t nat -A PREROUTING -d 192.168.1.148 -p tcp -m tcp --dport 4848 -j DNAT --to-destination 192.168.2.1:4848
I'm not saying your way is wrong, I am saying that I know that my way is working and looks clearer to me :) If you are permitting new connections, there isn't that much point in checking the state.

Not sure what your exact setup is, so hard to comment on the NAT settings. You might need to do nat at other end of tunnel, not on the VPN connection server.


All times are GMT -5. The time now is 05:14 PM.