1

I have setup a Softether VPN on an Ubuntu 14.04 server in an aws network which has about a dozen servers using this guide. The only difference is that I have used SecureNat and softether DHCP.

I can login to my server using ssh [email protected].

I added net.ipv4.ip_forward = 1 to sysctl and

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

My goal is to allow me to access remote LAN hosts with ssh [email protected] or http://hostname.domainname.com from my laptop using the vpn. I would appreciate any advice in achieving this.

3
  • Is domain.com available via public DNS, does it point back to your internal network, and are all of your target systems using publicly routable IP addresses? Jun 8, 2015 at 21:24
  • If it's VPN the target IP address probably look like 10.1.0.x and that has nothing to do with your public DNS. You can do ssh directly with public key authentication and that will be relative safe. Sorry this looks like a comment but I can't comment yet without 50 reputation.
    – user165025
    Jun 9, 2015 at 6:25
  • I know i can ssh directly anywhere in the lan, my goal is also the http access to a web server which faces the internet but has a protected back end web site. Jun 9, 2015 at 6:35

1 Answer 1

1

I'm not clear how far towards your goal, you've got, so apologies for asking obvious questions, but I'll start at the end, and work backwards.
1) Can you ssh [email protected] 2) can you ssh myname@ 3) can you nslookup hostname.mydomain.com and get 4) can you ping 5) if you traceroute how close do you get? 5.1) do you get as far as the remote side of the tunnel 5.2) did you get past the local site of the tunnel

I may be telling grandma how to suck eggs, but setting up vpn, is a 3 stage process. 1) set up the tunnel, either with either end creating the tunnel on some traffic event, or up permanently 2) ensure all the traffic that enters the tunnel leaves it with an address, that's identifiable by whats going to receive it (in your case the NATing server, but that means remote servers can't initiate conversations with your machine) 3) ensure that traffic that gets out of the remote side of the tunnel, can reach it's destination, and get back again. For this reason, I normally setup ICMP echo first, and leave it up, so I can check this stage, first, if I have any problems.

Just remember traceroute is your friend, and you will most likely need routing setup correctly, to get from each machine to the next. NAT complicates that, hence when I last setup a VPN myself, I ensured the private networks on both sides of the tunnel had different network addresses and could route between each other (in my case I had 192.168.A.x and 192.168.B.x and 192.168.C.x all bouncing off of a single publicly facing server, where each had to NAT from a different web location, to access the internet. That meant it was much easier, to tell each local DHCP server, to add routes, to the other networks, via the local entry point to the tunnel).

Hope that helps, sorry if it's just stating what you already knew.

1
  • I appreciate your comments and the time taken to write them. Because of a lack of response on this site (this is my first post here) I made significant progress yesterday on this problem but haven't solved the http issue as yet. Because of this progress the question became more of a serverfault issue rather than a general how to question so I posted it again on [serverfault] (serverfault.com/questions/697438/…) Jun 9, 2015 at 11:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .