Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I make my Access Point send traffic to 192.168.1.0 through eth0 and all other traffic through tun0?

I have set up a Raspberry Pi VPN access point. It sits on the same subnet as all my servers, 192.168.1.0 and is, as are the servers, connected by cable to my modem/router. The Raspberry Pi then has a WIFI stick (wlan0) for clients to connect to, it runs its own subnet 192.168.2.0 and uses iptables rules to forward all traffic from its clients on wlan0 through my VPN connection (tun0).

I set up this forward by doing;

sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sudo iptables -A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o tun0 -j ACCEPT

My problem is that now a client connected by wifi to my access point cannot communicate with my servers. How can I achieve this?

|                                            |       ¦
|                          __________________|_______¦_________
|                          |      Modem/Router/DCHP server    |
|                          |             192.168.1.254        |
|                          |_________________________¦________|
|                                            |       ¦
|                                            |       ¦
|                                  __________________¦_
|                                  |  8-port switch  ¦ |
|                                  |_________________¦_|
|                                    |             | ¦    
|                                    |             | -----------
|                ____________________|             |__________ ¦
|                |                                       eth0| ¦tun0
|        __________________                        ________________________
|        |    Server      |                        |  Pi VPN Access Point |
|        |  192.168.1.79  |                        |  eth0: 192.168.1.81  |
|        |________________|                        |  tun0: 10.X.X.X      |
|                                                  |  wlan0:192.168.2.1   |
|                                                  |______________________|
|                                                       |wlan0
|                                                       | 
|                                             __________|___________
|                                             |   Laptop           |
|                                             | wlan0: 192.168.2.2 |
|                                             |____________________|

I have described my Access Point setup more in detail at; http://www.snabela.net/index.php/2013/11/raspberry-vpn-access-point/

What do I need to do to be able to ssh from Laptop to Server whilst all Internet traffic from the AP's clients is sent through the VPN? Can I add another iptables rule?

The Access Points ifconfig -a output:

eth0      Link encap:Ethernet  HWaddr b8:28:eb:f1:77:93  
          inet addr:192.168.1.81  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:124292 errors:0 dropped:0 overruns:0 frame:0
          TX packets:86097 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:136739836 (130.4 MiB)  TX bytes:15199088 (14.4 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:60 errors:0 dropped:0 overruns:0 frame:0
          TX packets:60 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6200 (6.0 KiB)  TX bytes:6200 (6.0 KiB)

mon.wlan0 Link encap:UNSPEC  HWaddr F8-1B-67-20-B3-61-00-00-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4760 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:630721 (615.9 KiB)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.4.43.179  P-t-P:10.4.43.178  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:108875 errors:0 dropped:0 overruns:0 frame:0
          TX packets:75807 errors:0 dropped:29 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:126611820 (120.7 MiB)  TX bytes:6303503 (6.0 MiB)

wlan0     Link encap:Ethernet  HWaddr f8:1b:67:20:b3:61  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:75019 errors:0 dropped:0 overruns:0 frame:0
          TX packets:109376 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:7219164 (6.8 MiB)  TX bytes:130045181 (124.0 MiB)

The Access Point's route -n output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.4.43.178     128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
10.4.0.1        10.4.43.178     255.255.255.255 UGH   0      0        0 tun0
10.4.43.178     0.0.0.0         255.255.255.255 UH    0      0        0 tun0
95.211.191.34   192.168.1.254   255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.4.43.178     128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 wlan0
share|improve this question

1 Answer 1

I'll hazard a guess and say that your default FORWARD policy is to REJECT or DROP (check with iptables -L FORWARD). If that's correct, your entire problem is this line:

sudo iptables -A FORWARD -i wlan0 -o tun0 -j ACCEPT

What it does is to ACCEPT for FORWARDing anything that comes in through wlan0 and would go out through tun0. Which does not match a packet from 192.168.2.2 to 192.168.1.79, because that would go out through eth0.

The easiest thing to do is to remove that line and replace it with these two, to allow forwarding of everything in either direction between your internal interfaces:

sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -j ACCEPT

If you simply wish to exclude your server from the VPN, add -o wlan0 to the second line. Of course, if you want to add more, stricter requirements, such as session establishment having to go in a particular direction or whatever, these rules are the ones that need to be adjusted. Have fun, and keep a console handy. ;-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.