My network scheme:
|localhost| tun1--> VPN <--tun0 |work station| wlan0--> |router| --> (10.128.0.0/16)
localhost: Arch Linux x86-64
work station: CentOS 6 x86-64
I want to connect directly from localhost to 10.128.0.0/16 network, without SSH port forwardings and such. Work station has access to this network. Also, work station has static IP 10.255.255.252 in VPN.
tracepath from work station to host in 10.128.0.0/16:
$ tracepath 10.128.29.59 1?: [LOCALHOST] pmtu 1500 1: 192.168.225.1 (192.168.225.1) 15.293ms 1: 192.168.225.1 (192.168.225.1) 2.119ms 2: 192.168.225.1 (192.168.225.1) 2.085ms pmtu 1409 2: no reply 3: 10.128.29.59 (10.128.29.59) 15.655ms reached Resume: pmtu 1409 hops 3 back 3
192.168.255.1 is default gateway for work station:
$ ip route | grep default default via 192.168.225.1 dev wlan0
I tried just to add route on my localhost, but it failed:
# ip route add 10.128.0.0/16 via 10.255.255.252 RTNETLINK answers: Network is unreachable
I guess, that's pretty naive to add route to remote network in such way. How can I do this correctly? Maybe, I should share route table on 10.255.255.252 somehow?
I tried Marius suggestion
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
But it didn't change anything. iptables NAT tables now show this on workstation:
# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination
I'm able to connect to ports in 10.128.0.0/16 network using SSH port
ssh -L 5432:10.128.29.59:5432 email@example.com
After this forwarding I'm able to connect to 10.128.29.59:5432 via localhost:5432. So, what I really want is just option to connect directly to 10.128.29.59:5432.
I use openvpn to connect to VPN.
ip route on localhost:
$ ip route default via 192.168.1.1 dev wlp2s0 src 192.168.1.253 metric 302 10.0.0.0/16 via 192.168.193.29 dev tun1 10.255.0.0/16 via 192.168.193.29 dev tun1 192.168.1.0/24 dev wlp2s0 proto kernel scope link src 192.168.1.253 metric 302 192.168.193.0/24 via 192.168.193.29 dev tun1 192.168.193.29 dev tun1 proto kernel scope link src 192.168.193.30 184.108.40.206 via 192.168.193.29 dev tun1 220.127.116.11 via 192.168.193.29 dev tun1
ip route on workstation:
$ ip route 18.104.22.168 via 10.255.255.251 dev tun0 22.214.171.124 via 10.255.255.251 dev tun0 10.255.255.251 dev tun0 proto kernel scope link src 10.255.255.252 192.168.193.0/24 via 10.255.255.251 dev tun0 192.168.225.0/24 dev wlan0 proto kernel scope link src 192.168.225.165 10.0.0.0/16 via 10.255.255.251 dev tun0 10.255.0.0/16 via 10.255.255.251 dev tun0 default via 192.168.225.1 dev wlan0
nmap to one of interested ports in 10.128.0.0/16 from localhost:
$ nmap -p5432 10.128.29.59/32 Starting Nmap 7.31 ( https://nmap.org ) at 2016-11-02 11:40 MSK Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 3.11 seconds
$ nmap -p5432 10.128.29.59/32 Starting Nmap 5.51 ( http://nmap.org ) at 2016-11-02 11:42 MSK Nmap scan report for 10.128.29.59 Host is up (0.034s latency). PORT STATE SERVICE 5432/tcp open postgresql Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds