I have a very specific problem, building a Linux VPN endpoint (with external VPN Gateway), which should route certain networks over the tunnel, others via default gateway.
The Linux VPN should do a NAT on the outgoing connections for the VPN peers.

Setup is as following:
Internet gateway LAN
VPN Gateway LAN 
(VPN tunnel to net, separate connection to Internet)

Linux VPN Router
     route to via
     (send_redirects disabled, ip_forward enabled)
Linux clients (multiple):
   eth0   192.168.25.x/24
   route to via

Ping to the machines via tunnel from the VPN Router is working.

Now I want to establish a routing from my clients over the VPN gateway and the client packet gets routed to ! traceroute output shows the packets get routed to, but then to

So the route is not respected in forward !

IPTables and Routing:

ip route show via dev eth0 dev eth0  proto kernel  scope link  src dev eth0  proto kernel  scope link  src 
default via dev eth0 

iptables -A INPUT -i eth0:503 -j REJECT
iptables -t nat -A POSTROUTING -o eth0:503 -j MASQUERADE
iptables -A FORWARD -i eth0:503 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -o eth0:503 -j ACCEPT

So what is wrong with my setup ? The route is chosen correctly from localhost, but all the clients get forwarded to the Internet GW.

thanks for helping, Marcus

20121025: Found one problem at least: MASQUERADE will always mask as the main IP of the interface. When using SNAT, I am able to assign the address for NAT (which can be the alias address). The problem with packets dont get routed persists. I am working with Debian 6.

Tried the same setup with SNAT in a virtual Ubuntu 12.04 and got it to routing finally. So there seem to be a problem with Debian, or some setting I missed !

Working setup is (in Ubuntu 12.04 server):

iptables -t nat -A POSTROUTING -d -j SNAT --to-source=

So we have to re-install our servers, did not expect this could be a Debian problem !
Maybe somewhere between kernel (2.6.32 -> 3.2.0) and iptables (1.4.8 -> 1.4.12).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.