Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i have VPN setup which is like this:

########### internet  ############## internet  ############   LAN   ############
# macbook # --------> # VPN server #----------># PC A     # -------># PC B     #
#10.8.0.6 #           # 10.8.0.1   #           # 10.8.0.7 #         # 192.168..#
###########           ##############           ############         ############

and now i want to access the PC B in the local LAN of PC A ( A is in VPN net ) with my macbook, I can access PC A with my macbook, so VPN works, i just need some way to route the traffic from the macbook over PC A ( i guess ) to reach PC B in the LAN of PC A, i cant add PC B to the vpn net because i dont have (physical) access to it. ( i hope this is not too confusing ) how can i do this? VPN Server and PC A are running Debian,

any advice is greatly appreciated :), and sorry for my bad english

share|improve this question
    
You should add the addresses of PC A and PC B in the 192.168.. subnet. What local subnet does the macbook use, or is no router involved at the macbook location? –  JonnyJD Dec 31 '12 at 15:07
add comment

2 Answers

If you can modify the network on PC A then you can give it multiple IP addresses. Leave one in the 10.0.0.x range so you can keep communicating with PC A via the VPN server. Add a second IP to the NIC in 192.168.x.x range.

It is likely that you will need to add a route on PC A to indicate that it should use that IP/interface to communicate with PC B. Either via route add -net for the whole 192.168.x.x network or route add -host 192.168.a.b. netmask foo.bar.baz.foo (etc etc) for a single specific host.

Now you should be able to communicate from PC A to PC B.

If you are allowed to enable routing on PC A then you can also set it up so that you can reach PC B directly from your macbook or VPN server.

You can check this with cat /proc/sys/net/ipv4/ip_forward or enable it with sysctl -w net.ipv4.ip_forward=1


Also, the first internet between macbook en VPN server probably should be LAN. Routing of 10.x.x.x ranges to the internet quite non traditional. :)

share|improve this answer
    
I would guess PC A can already access PC B. This is why he wrote "LAN" above that connection. Also bot "internet" labels should indicated that the VPN server is on a different site than the macbook and PC A. Of course, there is lots of information missing about IPs and routing. –  JonnyJD Dec 25 '12 at 18:12
add comment

Your setup is not completely defined. I make this assumption:

  • PC A is already in the VPN and in the 192.168.. subnet. So PC A can reach PC B normally.

The exact addresses of PC A and PC B in the local subnet are not given, unfortunately.


Since you don't have control over PC B you have to create a port forwarding on PC A for every port you want access at PC B.

On debian you should forward ports using iptables. I have a similar setup with a opensuse machine that forwards RDP on PC B over the VPN. This would be on PC A.

pc_b=192.168...
macbook=10.8.0.6

case "$1" in
'start')
        iptables -F FORWARD
        iptables -t nat -F
        iptables -P FORWARD DROP
        echo 1 > /proc/sys/net/ipv4/ip_forward

        iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

        # VPN FORWARD of the RDP port (3389)
        iptables -A FORWARD -p tcp -s $pc_b --sport 3389 -d $macbook -j ACCEPT
        iptables -A FORWARD -p icmp -s $pc_b -d $macbook -j ACCEPT
        iptables -A FORWARD -p tcp -d $pc_b --dport 3389 -s $macbook -j ACCEPT

        iptables -A FORWARD -j REJECT

        # RDP from VPN
        iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 3389 \
                -j DNAT --to-destination $pc_b
        ;;
'stop')
        iptables -F FORWARD
        iptables -t nat -F
        iptables -P FORWARD ACCEPT
        echo 0 > /proc/sys/net/ipv4/ip_forward
        ;;
'status')
        iptables -t nat -L PREROUTING
        ;;
esac

This script accepts start, stop and status and can be used in rc.d as a run-level script on PC A tun0 is the VPN interface.

This will disallow any traffic between the 192.168.. subnet and the VPN except for the ports explicitely opened (3389 in this example). You don't have to disallow all other forwarding, but I would recommend it.

This will also forward access to 10.8.0.7:3389 to 192.168..:3389.


If you don't want to use port forwarding, you have to change the routing on PC B somehow. If you don't have access to PC B, then you need to route the traffic from the default gateway of PC B to the VPN. One possibility is to route traffic for the VPN from the default gateway to PC A.

This only works if you use a different subnet at the location of the macbook than the one used between PC A and PC B If you use some type of router with your macbook you probably also have a 192.168.. subnet there.

For this setup you don't use the previous script.

You still need

echo 1 > /proc/sys/net/ipv4/ip_forward

(same as sysctl -w net.ipv4.ipforward=1)

How to setup routing depends on the OS on the default gateway and your macbook. In general it works like this:

On macbook (route to PC B):

route add 192.168.. gw 10.8.0.7

This only works if there is no 192.168.. local subnet already present for the macbook!

On the default gateway of PC B (route to VPN over PC A):

route add 10.8.0.6 gw 192.168..

Of course, since the internal subnet addresses of PC A and PC B are not given by the question, I can't give the exact routing information either.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.