0

I have a tinc daemon running on Ubuntu virtual machine. My routing table looks like this:

default via 10.0.2.2 dev enp0s3  proto static  metric 100 
10.0.0.0/24 dev vpnnet  scope link 
10.0.2.0/24 dev enp0s3  proto kernel  scope link  src 10.0.2.15  metric 100 
169.254.0.0/16 dev enp0s3  scope link  metric 1000 

Where - 10.0.2.0/24 - local network subnet, 10.0.0.0/24 - VPN subnet

Interfaces:

vpnnet    Link encap:Ethernet  HWaddr b2:e8:0b:22:22:f1  
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::b0e8:bff:fe22:22f1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:62 errors:0 dropped:0 overruns:0 frame:0
          TX packets:47 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2736 (2.7 KB)  TX bytes:5760 (5.7 KB)

enp0s3    Link encap:Ethernet  HWaddr 08:00:27:12:d8:be  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::5333:40a8:822c:e6f9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6428 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2575 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6131799 (6.1 MB)  TX bytes:200156 (200.1 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:206 errors:0 dropped:0 overruns:0 frame:0
          TX packets:206 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15740 (15.7 KB)  TX bytes:15740 (15.7 KB)

enp0s3 - local interface name, vpnnet - VPN interface name. 10.0.0.1 - VPN server, 10.0.0.131 - VPN Client.

A client has it's default gateway replaced, so it can only ping server (10.0.0.1) but nothing else.

Client's routing table:

0.0.0.0/1 via 10.0.0.254 dev tap0
server-static-ip via 192.168.1.1 dev wlan0
10.0.0.0/8 dev tap0  proto kernel  scope link  src 10.0.0.131
10.0.0.254 dev tap0  scope link
128.0.0.0/1 via 10.0.0.254 dev tap0
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.46  metric 310
192.168.1.1 dev wlan0  scope link

I want client to be able to access the internet through my Ubuntu server. (Kinda like a proxy) As far as I understand, I need to route all traffic that comes in from my vpn client to internet through default gateway on enp0s3 and back. What changes do I need to make to my routing table/NAT to achieve this?

I looked at articles describing a way to resolve this using iptables POSTROUTING rules, but nothing seems to work for me.

Help!

  • "I want client to be able to access the network through my Ubuntu server."... Are you talking about split-tunneling? Can you clarify what you mean specifically by "the network" in this case that you describe your environment? Simple edit, clarify, and done!! – Pimp Juice IT Aug 25 '17 at 0:54
0

You didn't mention which gateway address the client uses. Is it set to 10.0.0.1 (your IP)? If so, everything's fine – just follow the exact same instructions (tutorials) for making your own router. Roughly:

  1. Enable IPv4 forwarding system-wide, using the net.ipv4.conf.all.forwarding sysctl;

  2. Add an iptables/nft masquerade rule, so that your clients' packets will be SNATed.

Alternatively (cleaner technically, but more configuration):

  1. Enable IPv4 forwarding;

  2. Don't do NAT, but configure your upstream router to have a static route towards 10.0.0.0/24 via your IP 10.0.2.15.

  • I updated the question with the client's routing table. 10.0.0.254 is a VPN tunnel ip, 192.168.1.1 - real router that the client uses. net.ipv4.conf.all.forwarding is enabled Can you clarify how would that rule look like? I've tried numerous things, nothing worked so far. – Noname135 Aug 25 '17 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.