2

I am sharing my internet connection / IKEv2 VPN connection over pf via Murus static NAT. My network architecture is as follows:

internet modem -> 
wired router (serving 192.168.1.1/24) -> 
Mac mini (192.168.1.2) -> ((en4) 192.168.2.1  ) ->
airport extreme (192.168.2.2) (DHCP, no NAT, serving 192.168.2.0/24)

I am sharing my internet / vpn connection via en4 to 192.168.2.0/24. Sharing internet works. Sharing the VPN works. I am doing DNS resolution on the router and not forwarding DNS requests through pf.

static nat via murus

However, certain sites (namely https://google.com) will not load. Other https sites will. ping google.com works fine on client and server. It resolves to different ip addresses on each, although both connections are behind the same VPN and use the same DNS servers.

curl google.com of course yields a 301. curl https://google.com works fine on the server, but curl -v https://google.com on the client yields the following if you wait long enough:

 stopped the pause stream!
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to google.com:443

The browser just times out. Both are running LibreSSL 2.2.7.

Wireshark output for the client and its preferred Google IP is pretty colorful, although unintelligible:

enter image description here

Strangely enough, the Safari browser seems to be using the server's Google IP and doesn't show up in this filter (this is from a curl request.)

I have had this working in the past, and am trying again with a different router and one less layer of NAT. I can't say it's always been snarl-free, but I was definitely able to browse sites like google.com with the shared VPN connection.

It should be noted that turning off the VPN causes the shared internet connection to work just fine.

What next steps do I need to take to figure out why some https connections don't work, and to get this network fully functional?

  • My guess is that you are not forwarding 443 port. Did you setup such port forwarding? – tukan Mar 5 '18 at 10:41
  • i don't know that port forwarding is needed here. how would you do it? – Walrus the Cat Mar 5 '18 at 20:20
  • Did you try it out? – tukan Mar 7 '18 at 11:01
0

I don't have a murus firewall, I somewhat understand iptables/pf I commented on that basis.

Since I have the basis I took the liberty to search for a source/screenshot which would show you how to do it in Murus.

I have found these sources:

1) You can read the Murus manual (section 7)

2) You can check this screenshot which is similar (different service and port, but same logic)

For SSH service and port 2222, you can see at bottom (forward service to NAT client): SSH port forwarding

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.