Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?


 
Thread Tools Search this Thread
Special Forums IP Networking Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?
# 1  
Old 04-23-2008
Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Hi all!


We have a setup of three computers;
Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0)

hso0 is the packet interface of a 3G modem, it behaves like a normal network interface.

Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a client that receives Network-configuration using DHCP from Machine B automatically.

Machine A eth0 : DHCP
Machine B eth0 : 192.168.2.1
Machine B hso0 : Static IP addr, Internet use
Machine B tun0 : 10.11.0.10 (openVPN client)
Machine C eth0 : Static IP addr, Internet use
Machine C tun0 : 10.11.0.1 (openVPN server)

OpenVPN (server) is configured to allow Internet-traffic to its clients. Code in server.conf:
# Make sure clients traverse tun0 when accessing Internet
push "redirect-gateway def1"
# Push a DNS server (handled by openVPN)
push "dhcp-option DNS 10.11.0.1"

We're having issues to make Machine C release Internet traffic from Machine A. Note that we have setup masquerading on Machine B using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.
Currently Iptables on Machine B and Machine C have a policy of ACCEPT.

We have managed to make traffic from Machine A reach Machine C, but only with the internal IP of 192.168.2.48 (DHCP).
OpenVPN drops those packets (as it should!) because they come from 192.* and not 10.*

Is there a way to solve this? Thank you!
# 2  
Old 04-24-2008
Expore options to iptables command

Before making NAT for -o eth0 you give
iptables -t nat -I POSTROUTING -p 50 -j ACCEPT
Here 50 is protocol number for ipsec-ESP
You may require to add similar iptable for --proto 51 i.e. ipsec-AH
# 3  
Old 08-28-2008
IP Tablets

Linux IPTables, Linux IPChains, BSD IPF and other packet filters do not prevent snort from seeing a packet that is present on the network wire. Even if an inbound packet is denied by the packet filter Snort will still see and analyze the packet if it is listening to that interface.

--------------------------------
Angelinjones


Get Website Traffic
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Cybersecurity

Openvpn nat and iptables

good day good people hi first to tell that firewall and vpn is working as expected, but I notice something strange. I have host system 11.11.11.11(local ip) firewall is blocking everything except port to vpn. I have vpn on virtualized system 22.22.22.22 (CentOS both host and virtual). ... (0 Replies)
Discussion started by: end
0 Replies

2. Debian

Linux outbound traffic filtering with: cgroups + tc + iptables

I spent a lot of time trying to implement outbound traffic filtering with: cgroups + tc + iptables on Debian Jessie. Unfortunately there is still something wrong. The biggest issue is: - cgroups install + config - net_cls subsystem implementation - packets marking with net_cls - appropriate... (0 Replies)
Discussion started by: Novi
0 Replies

3. UNIX for Dummies Questions & Answers

iptables for openvpn

Hey all, I'm trying to get openvpn working on DD-WRT router. I can make a connection inside my lan, but outside the connection is yellow. I think yellow means it is close to making a connection, but it never completes the connection. So I believe there is a problem with my iptables since it... (0 Replies)
Discussion started by: sdnix
0 Replies

4. IP Networking

Dividing traffic with u32 iptables filter

I would like to divide traffic between two squid servers. I have been thinking about using iptables u32 filter, to check last bit of ip address which is comming to gateway. Then I would like to direct even IP adresses to one squid host, and odd to the other. Is it reasonable ? Thank you for... (2 Replies)
Discussion started by: new_item
2 Replies

5. Ubuntu

Iptables forward traffic to forward chain!!!

Hi, I am new to linux stuff. I want to use linux iptables to configure rule so that all my incoming traffic with protocol "tcp" is forwarded to the "FORWARD CHAIN". The traffic i am dealing with has destination addresss of my machine but i want to block it from coming to input chain and somehow... (0 Replies)
Discussion started by: arsipk
0 Replies

6. IP Networking

Traffic shaping with iptables

hello, I have a postfix & a local dns running on a single server. this server is connected to internet via a low bandwidth line(with fixed ip). we also have another high speed adsl (dynamic ip). i want to divert all dns request from the local dns & postfix from the server to the adsl... (0 Replies)
Discussion started by: coolatt
0 Replies

7. IP Networking

OPENVPN on FREEBSD

Hello gurus , I have a vmware machine on xp wich holds a FREBSD 8.0 BETA2 i386 my xp ip is 192.168.0.12 my freebsd le0 ( ext iface, vmware bridged ) is 192.168.0.105 ( can ping google; etc...) my freebsd le2 (int iface, vmware local only) is 192.168.141.5 my freebsd le1 is disabled as... (0 Replies)
Discussion started by: cozsmin
0 Replies

8. Shell Programming and Scripting

Block incoming traffic FTP from internet using iptables

Hi everybody. I have the next scenary: eth0: WAN eth1: DMZ eth2: LAN I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles. I have been listening about iptables -A FORDAWARD but I am stuck right... (0 Replies)
Discussion started by: edeamat
0 Replies

9. IP Networking

Forwarding the IP packet from tun0 to/from eth0

Hi all, I am working on TUN/TAP for tunnelling IP packets from the application to the network. I am able to open the tun device and assign the IP address to tun0. The steps I followed are given, 1. Opened the tun device /dev/net/tun 2. Assigned a IP address to the tun0 using ifconfig... (5 Replies)
Discussion started by: johnniealan
5 Replies

10. IP Networking

measuring traffic with iptables

i have a wireless network that is connected to internet over nat.there is ap that is connected to another ap in bridge mode, on ap is used for clients, and the other is connected to the machine that is doing masquerading. so i want to measure traffic of my clients and i thought about doing it with... (0 Replies)
Discussion started by: mdfk
0 Replies
Login or Register to Ask a Question