4

I have two sites. Site 1 has a router with a public IP A.B.C.D as well as a private range 192.168.13.0/24. The router also occupies the private IP 192.168.13.1. Site 2 is a single host with a public IP X.Y.Z.W.

The problem is that site 2 is behind a firewall not under my control. As a result, site 2 can access site 1 at A.B.C.D but site 1 cannot access site 2 directly.

To work around the limitation, I configured site 2 to connect to site 1's router over an OpenVPN tunnel, and using iproute2 source policy routing to redirect traffic from the private range (except the router itself) to X.Y.Z.W to go through the tunnel. For example, I have to use the following command on the router at site 1

ip rule add from 192.168.13.32/27 to X.Y.Z.W lookup vpn

to redirect traffic from the block 192.168.13.32/27 to X.Y.Z.W to consult the routing table vpn in which the default gate is the OpenVPN endpoint. I have to use source policy routing to exclude the router (which is at 192.168.13.1), otherwise the VPN traffic would not be routed back to X.Y.Z.W correctly.

So far everything is working fine, but I'm not very happy with the source policy routing because it requires me to change the ip rule every time private range 192.168.13.0/24 is changed, or more sub-blocks is added.

I'm wondering if there is any easier way to make X.Y.Z.W available to site 1's private range without using source policy routing?

Improve this question

1 Answer 1

Reset to default
2

After Site 2 opens the VPN tunnel it should be assigned an IP, e.g. 10.10.10.2, and a route should appear on the router (acting as VPN Server) pointing to this IP.

You can use Destination NAT instead of policy routing, by matching all traffic whose destination is the public IP X.Y.Z.W, and that are incoming only from the router LAN Interface, and NATTing the destination to 10.10.10.2.

This will route all traffic going to Site 2 through the VPN tunnel automatically, and it will hit the public host.

Improve this answer
4
  • Thanks for the answer! The problem is with destination NAT the underlying VPN traffic to X.Y.Z.W will be (incorrectly) routed via the VPN tunnel too, sorta creating a loop that never works… That's why I ended up with source policy routing in the first place.
    – Rio
    Jan 7, 2014 at 2:22
  • The tunnel physical endpoints are ABCD and XYZW, right ? 192.168.13.1 should not be sending traffic to the public host XYZW, right ? I have edited my answer to say only incoming LAN Traffic to be NATTed.
    – aseaudi
    Jan 7, 2014 at 10:48
  • I see what you meant now. What command should I use to match the traffic only from the LAN interface? ip route?
    – Rio
    Jan 10, 2014 at 3:18
  • try "iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -j DNAT --to-destination 10.10.10.2"
    – aseaudi
    Jan 10, 2014 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.