1

I have two linux hosts on my home network, host1 and host2. I'm trying to configure it so that host1 is connected to a vpn, and host2 can send packets out over the vpn by routing through host1. My naive attempt was to run

root@host1 # iptables -A FORWARD -i wlp2s0 -o tun0 -j ACCEPT
root@host1 # iptables -A FORWARD -i tun0 -o wlp2s0 -j ACCEPT 
root@host1 # iptables -A INPUT -i wlp2s0 -j ACCEPT
root@host1 # iptables -A INPUT -i tun0  -j ACCEPT 
root@host1 # iptables -A OUTPUT -o tun0 -j ACCEPT
root@host1 # iptables -A OUTPUT -o wlp2s0 -j ACCEPT 

on the routing host, and

user@host2 $ sudo ip route add 104.24.122.145/32 via 10.0.0.76 dev wlp58s0
user@host2 $ curl 104.24.122.145 -H 'Host: ifconfig.io' 

on the other host. The idea was that if everything behaved as expected, I could get my home ip address by hitting one of ifconfig.io's ips, and the vpn ip address by hitting the other one.

However, when I run that curl command it times-out, and the iptable logs don't seem to indicate that any traffic is hopping through. (Presumably the INPUT and OUTPUT packets are all from background traffic).

root@host1 # sudo iptables -L -vn 
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   383 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
    8   847 ACCEPT     all  --  wlp2s0 *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  tun0   wlp2s0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  wlp2s0 tun0    0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   459 ACCEPT     all  --  *      wlp2s0  0.0.0.0/0            0.0.0.0/0           
    2   151 ACCEPT     all  --  *      tun0    0.0.0.0/0            0.0.0.0/0          

What have I missed? I'm using this as a baseline for understanding. I haven't followed it exactly, but I can't see what I'm doing wrong.

1 Answer 1

0

You need to enable ip forwarding:

  1. Edit /etc/sysctl.conf. Uncomment the line

    net.ipv4.ip_forward=1

  2. Reload the new settings:

    sudo sysctl -p /etc/sysctl.conf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .