VPN Client behind Linux firewall/router

deadline · 12-08-2006, 05:02 PM

Hi guys!
I have a situation, that I need to connect to my work vpn, but my vpn pptp client is on local network behind linux router (Slackware with 2.4.22 kernel)! I have tried to configure my Linux router box with iptables, but it seems that I haven't got any progress.
So far I have tried the following:

Code:

iptables -I FORWARD  -p 47 -j ACCEPT 
iptables -I FORWARD  -p tcp --dport 1723 -j ACCEPT

And also:

Code:

iptables -t nat -A PREROUTING -d 80.80.80.80 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -d 80.80.80.80 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

Where 80.80.80.80 would be the public address of my local network (linux router eth0), but 1.1.1.1 is the address of PC in my local network, where the VPN client is.

Could anyone help me to solve the problem, please?

amitsharma_26 · 12-08-2006, 05:20 PM

You can use

Code:

watch -n1 "iptables -t nat -nvL"

to have a look at the counters while you try to connect to this VPN from outside to see whether these packets are actually matching these rules or not.

If they match these rules & you see counters moving, then we can further do the troubleshooting at the LAN part or a POSTROUTING rule can do the rest.

deadline · 12-08-2006, 05:53 PM

I checked but it seems that there was no activity (I coudn test it right now, but it seems, that there wasn't any activity earlier). The only activity is for rules below, but I thin they are wrong, because eth1 is the nic for local area network of linux router..

Code:

iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

Right now I have both of these rules shown above, with eth0 and eth1 as interfaces, but I think I should remove those with eth1! am I right?

best regards,
deadline

deadline · 12-08-2006, 05:55 PM

I would leave the folowing rules:

Code:

iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

and delete:

Code:

iptables -t nat -A PREROUTING -i eth1 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

deadline · 12-08-2006, 06:05 PM

Am I right?

amitsharma_26 · 12-08-2006, 06:10 PM

Quote:

Originally Posted by deadline

I would leave the folowing rules:

Code:

iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

Yea that is ok, Can you see the

Code:

watch -n1 " iptables -t nat -nvL"

now for any counter change ?

deadline · 12-08-2006, 06:26 PM

I am afraid that i can't test it right now

, because the person who is having the computer of vpn client, which needs to connect to vpn is not currently available, but I haven't got access rights to that vpn! I will try to test it as soon as possible!
Is there anything else wich is important to set it up or is it enough with rules mentioned earlier?

Code:

iptables -I FORWARD  -p 47 -j ACCEPT 
iptables -I FORWARD  -p tcp --dport 1723 -j ACCEPT

and

Code:

iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 1.1.1.1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

best regards,
deadline

amitsharma_26 · 12-08-2006, 06:39 PM

Make sure that your 1.1.1.1 box should be having your this firewall box as its gateway or otherwise you got to add another POSTROUTING rule as well.
Rest is OK.

ANd yea.. i hope you must be having ip forwarding enabled at your box, You can check it with

Code:

cat /proc/sys/net/ipv4/ip_forward

deadline · 12-08-2006, 06:50 PM

Yes it is set up as a gateway for my 1.1.1.1 box and /proc/sys/net/ipv4/ip_forward is set up to "1" at linux router box.
I have another question... Is it necessary also to pass the source and destination parameters in rules? I have also tried rules which mach the destination (they are actually applied, but are below rules I mentioned above when I try watch -n1 " iptables -t nat -nvL"):

Code:

iptables -t nat -A PREROUTING -d 80.80.80.80 -p tcp --dport 1723 -j DNAT --to 1.1.1.1

And the same rule with gre protocol! Are these rules necessary?

Best regards,
deadline

deadline · 12-09-2006, 01:27 AM

It seems that it is working! Thank You very much Amit!

amitsharma_26 · 12-09-2006, 09:03 AM

You are welcome, but i aint did anything. It was you all the way who sorted out this query. I was just trying to be curious & suggestive.

swilsonjr · 12-22-2006, 12:03 PM

How can i use this setup to allow DHCP clients to access their VPN's? I've tried:

iptables -t nat -A PREROUTING -i eth0 -p 47 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j ACCEPT