connect to subnet via VPN

Question

i have VPN setup which is like this:

########### internet  ############## internet  ############   LAN   ############
# macbook # --------> # VPN server #----------># PC A     # -------># PC B     #
#10.8.0.6 #           # 10.8.0.1   #           # 10.8.0.7 #         # 192.168..#
###########           ##############           ############         ############

and now i want to access the PC B in the local LAN of PC A ( A is in VPN net ) with my macbook, I can access PC A with my macbook, so VPN works, i just need some way to route the traffic from the macbook over PC A ( i guess ) to reach PC B in the LAN of PC A, i cant add PC B to the vpn net because i dont have (physical) access to it. ( i hope this is not too confusing ) how can i do this? VPN Server and PC A are running Debian,

any advice is greatly appreciated :), and sorry for my bad english

Answer 1

If you can modify the network on PC A then you can give it multiple IP addresses. Leave one in the 10.0.0.x range so you can keep communicating with PC A via the VPN server. Add a second IP to the NIC in 192.168.x.x range.

It is likely that you will need to add a route on PC A to indicate that it should use that IP/interface to communicate with PC B. Either via route add -net for the whole 192.168.x.x network or route add -host 192.168.a.b. netmask foo.bar.baz.foo (etc etc) for a single specific host.

Now you should be able to communicate from PC A to PC B.

If you are allowed to enable routing on PC A then you can also set it up so that you can reach PC B directly from your macbook or VPN server.

You can check this with cat /proc/sys/net/ipv4/ip_forward or enable it with sysctl -w net.ipv4.ip_forward=1

Also, the first internet between macbook en VPN server probably should be LAN. Routing of 10.x.x.x ranges to the internet quite non traditional. :)

Answer 2

Your setup is not completely defined. I make this assumption:

• PC A is already in the VPN and in the 192.168.. subnet. So PC A can reach PC B normally.

The exact addresses of PC A and PC B in the local subnet are not given, unfortunately.

---

Since you don't have control over PC B you have to create a port forwarding on PC A for every port you want access at PC B.

On debian you should forward ports using iptables. I have a similar setup with a opensuse machine that forwards RDP on PC B over the VPN. This would be on PC A.

pc_b=192.168...
macbook=10.8.0.6

case "$1" in
'start')
        iptables -F FORWARD
        iptables -t nat -F
        iptables -P FORWARD DROP
        echo 1 > /proc/sys/net/ipv4/ip_forward

        iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

        # VPN FORWARD of the RDP port (3389)
        iptables -A FORWARD -p tcp -s $pc_b --sport 3389 -d $macbook -j ACCEPT
        iptables -A FORWARD -p icmp -s $pc_b -d $macbook -j ACCEPT
        iptables -A FORWARD -p tcp -d $pc_b --dport 3389 -s $macbook -j ACCEPT

        iptables -A FORWARD -j REJECT

        # RDP from VPN
        iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 3389 \
                -j DNAT --to-destination $pc_b
        ;;
'stop')
        iptables -F FORWARD
        iptables -t nat -F
        iptables -P FORWARD ACCEPT
        echo 0 > /proc/sys/net/ipv4/ip_forward
        ;;
'status')
        iptables -t nat -L PREROUTING
        ;;
esac

This script accepts start, stop and status and can be used in rc.d as a run-level script on PC A tun0 is the VPN interface.

This will disallow any traffic between the 192.168.. subnet and the VPN except for the ports explicitely opened (3389 in this example). You don't have to disallow all other forwarding, but I would recommend it.

This will also forward access to 10.8.0.7:3389 to 192.168..:3389.

---

If you don't want to use port forwarding, you have to change the routing on PC B somehow. If you don't have access to PC B, then you need to route the traffic from the default gateway of PC B to the VPN. One possibility is to route traffic for the VPN from the default gateway to PC A.

This only works if you use a different subnet at the location of the macbook than the one used between PC A and PC B If you use some type of router with your macbook you probably also have a 192.168.. subnet there.

For this setup you don't use the previous script.

You still need

echo 1 > /proc/sys/net/ipv4/ip_forward

(same as sysctl -w net.ipv4.ipforward=1)

How to setup routing depends on the OS on the default gateway and your macbook. In general it works like this:

On macbook (route to PC B):

route add 192.168.. gw 10.8.0.7

This only works if there is no 192.168.. local subnet already present for the macbook!

On the default gateway of PC B (route to VPN over PC A):

route add 10.8.0.6 gw 192.168..

Of course, since the internal subnet addresses of PC A and PC B are not given by the question, I can't give the exact routing information either.