Hi all, Please consider the following config:
VPN CLIENT ---------------------- External IP: 188.8.131.52 Internal VPN IP: 10.0.0.2 Default gw: 10.0.0.1
VPN SERVER ----------------------- External IP: 184.108.40.206 Internal VPN IP: 10.0.0.1
All traffic on the VPN client is routed through the VPN server using: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE ipatbles -A FORWARD -s 10.0.0.0/24 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -j REJECT //block the rest
eth0: external NIC on the server
Ok, the gw works on the client so I have internet connection on it. The problem occurs when an external host tries to access for example the http server on the client (http://220.127.116.11) or pinging the client. Since the default gw on the client is the vpn server, I did a tcpdump -i tap0 (vpn interface) on the server to display some echo replies on the pings. And I received (on tap0 interface) these echo replies which weren't routed back to the pinging host. The output was:
21:11:14.983343 18.104.22.168 > 22.214.171.124: icmp: echo reply (DF)
where 126.96.36.199 is the host from where I started to ping.
Somewere on the vpn server the packets are filtered and not sent to the pinging host. Same for all the connections which have as destination client's external IP. How can I use client's services for external hosts (with no link to the vpn)? Some tweaks on client's routing table? Or the server's packet mangling is faulty?
Any help is greatly appreciated since I used all my ideas on the issue.