1

I have setup a Softether VPN on an Ubuntu 14.04 server in an aws network which has about a dozen servers using this guide. The only difference is that I have used SecureNat and softether DHCP.

I can login to my server using ssh myname@10.0.0.10.

I added net.ipv4.ip_forward = 1 to sysctl and

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

My goal is to allow me to access remote LAN hosts with ssh myname@hostname.mydomain.com or http://hostname.domainname.com from my laptop using the vpn. I would appreciate any advice in achieving this.

3
  • Is domain.com available via public DNS, does it point back to your internal network, and are all of your target systems using publicly routable IP addresses? Jun 8 '15 at 21:24
  • If it's VPN the target IP address probably look like 10.1.0.x and that has nothing to do with your public DNS. You can do ssh directly with public key authentication and that will be relative safe. Sorry this looks like a comment but I can't comment yet without 50 reputation.
    – raynix
    Jun 9 '15 at 6:25
  • I know i can ssh directly anywhere in the lan, my goal is also the http access to a web server which faces the internet but has a protected back end web site. Jun 9 '15 at 6:35
1

I'm not clear how far towards your goal, you've got, so apologies for asking obvious questions, but I'll start at the end, and work backwards.
1) Can you ssh myname@hostname.mydomain.com 2) can you ssh myname@ 3) can you nslookup hostname.mydomain.com and get 4) can you ping 5) if you traceroute how close do you get? 5.1) do you get as far as the remote side of the tunnel 5.2) did you get past the local site of the tunnel

I may be telling grandma how to suck eggs, but setting up vpn, is a 3 stage process. 1) set up the tunnel, either with either end creating the tunnel on some traffic event, or up permanently 2) ensure all the traffic that enters the tunnel leaves it with an address, that's identifiable by whats going to receive it (in your case the NATing server, but that means remote servers can't initiate conversations with your machine) 3) ensure that traffic that gets out of the remote side of the tunnel, can reach it's destination, and get back again. For this reason, I normally setup ICMP echo first, and leave it up, so I can check this stage, first, if I have any problems.

Just remember traceroute is your friend, and you will most likely need routing setup correctly, to get from each machine to the next. NAT complicates that, hence when I last setup a VPN myself, I ensured the private networks on both sides of the tunnel had different network addresses and could route between each other (in my case I had 192.168.A.x and 192.168.B.x and 192.168.C.x all bouncing off of a single publicly facing server, where each had to NAT from a different web location, to access the internet. That meant it was much easier, to tell each local DHCP server, to add routes, to the other networks, via the local entry point to the tunnel).

Hope that helps, sorry if it's just stating what you already knew.

1
  • I appreciate your comments and the time taken to write them. Because of a lack of response on this site (this is my first post here) I made significant progress yesterday on this problem but haven't solved the http issue as yet. Because of this progress the question became more of a serverfault issue rather than a general how to question so I posted it again on [serverfault] (serverfault.com/questions/697438/…) Jun 9 '15 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.