Simple VPN routing configuration
up vote
0
down vote
favorite
I have a very simple VPN setup using tinc that works perfectly well. I would like to be able to route WAN traffic through one host, but I cannot seem to figure out how to get the routing table correct.
Host A (server):
eth0 -> WAN -> <publicip>
tun0 -> VPN -> 10.0.0.1
Host B (client):
wlp6s0 -> LAN -> 10.0.1.27
tun0 -> VPN -> 10.0.0.3
Here is what I have done so far:
On the server side, enabled IP forwarding and masquerade in iptables:
# iptables -t nat -A POSTROUTING -s 10.0.0.3 -o eth0 -j MASQUERADE
Here is what my client table looks like before touching the routing table:
default via 10.0.1.1 dev wlp6s0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
As you can see, 10.0.1.1 is the LAN gateway. Both the client and server are able to ping each other over the VPN.
Now, what I have tried to apply to the routing table on the client:
# ip route add <publicip> via 10.0.1.1 # so that I don't take down tunnel as in https://unix.stackexchange.com/questions/420633
# ip route del default via 10.0.1.1
# ip route add default via 10.0.0.1
My table now looks like so:
default via 10.0.0.1 dev tun0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
<publicip> via 10.0.1.1 dev wlp6s0
I am still able to pass traffic back and forth between client and server over VPN tunnel. But, WLAN-destined traffic from the client returns "Destination Net Unknown" and I do not see any incoming packets on the server side. What am I doing wrong?
routing vpn nat iproute
asked Nov 19 at 3:06
matoro
32
add a comment |
up vote
0
down vote
favorite
I have a very simple VPN setup using tinc that works perfectly well. I would like to be able to route WAN traffic through one host, but I cannot seem to figure out how to get the routing table correct.
Host A (server):
eth0 -> WAN -> <publicip>
tun0 -> VPN -> 10.0.0.1
Host B (client):
wlp6s0 -> LAN -> 10.0.1.27
tun0 -> VPN -> 10.0.0.3
Here is what I have done so far:
On the server side, enabled IP forwarding and masquerade in iptables:
# iptables -t nat -A POSTROUTING -s 10.0.0.3 -o eth0 -j MASQUERADE
Here is what my client table looks like before touching the routing table:
default via 10.0.1.1 dev wlp6s0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
As you can see, 10.0.1.1 is the LAN gateway. Both the client and server are able to ping each other over the VPN.
Now, what I have tried to apply to the routing table on the client:
# ip route add <publicip> via 10.0.1.1 # so that I don't take down tunnel as in https://unix.stackexchange.com/questions/420633
# ip route del default via 10.0.1.1
# ip route add default via 10.0.0.1
My table now looks like so:
default via 10.0.0.1 dev tun0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
<publicip> via 10.0.1.1 dev wlp6s0
I am still able to pass traffic back and forth between client and server over VPN tunnel. But, WLAN-destined traffic from the client returns "Destination Net Unknown" and I do not see any incoming packets on the server side. What am I doing wrong?
routing vpn nat iproute
asked Nov 19 at 3:06
matoro
32
Are there any NAT rules on the client? What doesip route get 1.1.1.1show on the client?
– wurtel
Nov 19 at 15:08
It gives me the expected route, at least as I read it:1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000But a tracepath never even makes it to the gateway:1?: [LOCALHOST] pmtu 15001: ??? 0.067ms !N1: ??? 0.100ms !N
– matoro
Nov 19 at 19:31
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have a very simple VPN setup using tinc that works perfectly well. I would like to be able to route WAN traffic through one host, but I cannot seem to figure out how to get the routing table correct.
Host A (server):
eth0 -> WAN -> <publicip>
tun0 -> VPN -> 10.0.0.1
Host B (client):
wlp6s0 -> LAN -> 10.0.1.27
tun0 -> VPN -> 10.0.0.3
Here is what I have done so far:
On the server side, enabled IP forwarding and masquerade in iptables:
# iptables -t nat -A POSTROUTING -s 10.0.0.3 -o eth0 -j MASQUERADE
Here is what my client table looks like before touching the routing table:
default via 10.0.1.1 dev wlp6s0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
As you can see, 10.0.1.1 is the LAN gateway. Both the client and server are able to ping each other over the VPN.
Now, what I have tried to apply to the routing table on the client:
# ip route add <publicip> via 10.0.1.1 # so that I don't take down tunnel as in https://unix.stackexchange.com/questions/420633
# ip route del default via 10.0.1.1
# ip route add default via 10.0.0.1
My table now looks like so:
default via 10.0.0.1 dev tun0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
<publicip> via 10.0.1.1 dev wlp6s0
I am still able to pass traffic back and forth between client and server over VPN tunnel. But, WLAN-destined traffic from the client returns "Destination Net Unknown" and I do not see any incoming packets on the server side. What am I doing wrong?
routing vpn nat iproute
asked Nov 19 at 3:06
matoro
32
I have a very simple VPN setup using tinc that works perfectly well. I would like to be able to route WAN traffic through one host, but I cannot seem to figure out how to get the routing table correct.
Host A (server):
eth0 -> WAN -> <publicip>
tun0 -> VPN -> 10.0.0.1
Host B (client):
wlp6s0 -> LAN -> 10.0.1.27
tun0 -> VPN -> 10.0.0.3
Here is what I have done so far:
On the server side, enabled IP forwarding and masquerade in iptables:
# iptables -t nat -A POSTROUTING -s 10.0.0.3 -o eth0 -j MASQUERADE
Here is what my client table looks like before touching the routing table:
default via 10.0.1.1 dev wlp6s0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
As you can see, 10.0.1.1 is the LAN gateway. Both the client and server are able to ping each other over the VPN.
Now, what I have tried to apply to the routing table on the client:
# ip route add <publicip> via 10.0.1.1 # so that I don't take down tunnel as in https://unix.stackexchange.com/questions/420633
# ip route del default via 10.0.1.1
# ip route add default via 10.0.0.1
My table now looks like so:
default via 10.0.0.1 dev tun0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.3
10.0.1.0/24 dev wlp6s0 proto dhcp scope link src 10.0.1.27 metric 303
<publicip> via 10.0.1.1 dev wlp6s0
I am still able to pass traffic back and forth between client and server over VPN tunnel. But, WLAN-destined traffic from the client returns "Destination Net Unknown" and I do not see any incoming packets on the server side. What am I doing wrong?
routing vpn nat iproute
routing vpn nat iproute
asked Nov 19 at 3:06
matoro
32
asked Nov 19 at 3:06
matoro
32
asked Nov 19 at 3:06
matoro
32
asked Nov 19 at 3:06
matoro
32
asked Nov 19 at 3:06
matoro
32
32
Are there any NAT rules on the client? What doesip route get 1.1.1.1show on the client?
– wurtel
Nov 19 at 15:08
It gives me the expected route, at least as I read it:1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000But a tracepath never even makes it to the gateway:1?: [LOCALHOST] pmtu 15001: ??? 0.067ms !N1: ??? 0.100ms !N
– matoro
Nov 19 at 19:31
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45
add a comment |
Are there any NAT rules on the client? What doesip route get 1.1.1.1show on the client?
– wurtel
Nov 19 at 15:08
It gives me the expected route, at least as I read it:1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000But a tracepath never even makes it to the gateway:1?: [LOCALHOST] pmtu 15001: ??? 0.067ms !N1: ??? 0.100ms !N
– matoro
Nov 19 at 19:31
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45
Are there any NAT rules on the client? What does
ip route get 1.1.1.1 show on the client?– wurtel
Nov 19 at 15:08
Are there any NAT rules on the client? What does
ip route get 1.1.1.1 show on the client?– wurtel
Nov 19 at 15:08
It gives me the expected route, at least as I read it:
1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000 But a tracepath never even makes it to the gateway: 1?: [LOCALHOST] pmtu 1500 1: ??? 0.067ms !N 1: ??? 0.100ms !N– matoro
Nov 19 at 19:31
It gives me the expected route, at least as I read it:
1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000 But a tracepath never even makes it to the gateway: 1?: [LOCALHOST] pmtu 1500 1: ??? 0.067ms !N 1: ??? 0.100ms !N– matoro
Nov 19 at 19:31
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f482654%2fsimple-vpn-routing-configuration%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Are there any NAT rules on the client? What does
ip route get 1.1.1.1show on the client?– wurtel
Nov 19 at 15:08
It gives me the expected route, at least as I read it:
1.1.1.1 via 10.0.0.1 dev tun0 src 10.0.0.3 uid 1000But a tracepath never even makes it to the gateway:1?: [LOCALHOST] pmtu 15001: ??? 0.067ms !N1: ??? 0.100ms !N– matoro
Nov 19 at 19:31
Hmm, no idea, besides maybe you have iptables rules getting in the way?
– wurtel
Nov 20 at 7:45