I have 3 Linux servers:

  • - ( Linux server inside my LAN.
  • - ( Linux server with HTTP Apache server
  • - Server on Amazon AWS which see both 10.x and 20.x LANs.

10.x cannot see 20.x and 20.x cannot see 10.x
What is the best way (and how can I do it) to se server on AWS to create tunnel from 10.x to 20.x runs HTTPd server on "DMZ" LAN. I need to see from my servers.
The 2 networks 10.x and 20.x is on the same Cisco ASA firewall/router, but I cannot route because of License issues, so i want to bypass this by external server which can see 20.x network. I want to be able to go to from 10.x servers and see content.

  • It seems to me that there are already two tunnels so that none needs to be created any more. In that case you just have to (a) configure routing in both networks (making the tunnel address of the gateway for the other network) and (b) allow forwarding between the two tunnel interfaces on – Hauke Laging May 5 '14 at 8:03
  • So instead of Tunnel I need to make as a router? – gabi May 5 '14 at 8:18
  • If that's what you want. You could also create a direct tunnel between the networks but that would be completely independent of – Hauke Laging May 5 '14 at 8:23
  • Actually I dont want to be able to route back from 20.x to 10.x (10.x is my private internal LAN and 20.x is my "DMZ" ) so it looks like tunnel is my best option here, no? – gabi May 5 '14 at 8:24
  • Is actually available for local use? I thought only, and were available for local use. – celtschk May 5 '14 at 8:46

You describe quite different cases in your question. If you want to reach only 20.x:80 via then you can configure port forwarding on with iptables:

iptables -t nat -A PREROUTING -s -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -s -d "$target_ip" -p tcp --dport 80 -j SNAT --to-source "$source_ip"
iptables -A FORWARD -s -d "$target_ip" -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d -s "$target_ip" -p tcp --sport 80 -j ACCEPT
echo 1 >/proc/sys/net/ipv4/ip_forward

If there is a tunnel between and then you probably have to set $source_ip to the tunnel interface IP address.

  • I probably misunderstood the terms. Tunnel is the ability to access specific machine you cannot access directly, with another server which can access to the machine, no? so it is my case here - I need to access (assume it is real external valid IP) from (Private LAN - non legal IP). 10.x cannot see 20.x , but EC2 machine can see it.. – gabi May 5 '14 at 8:48
  • "Tunnel" is a general term. My understanding of it is: You create a transparent connection between hosts or networks in both directions. Thus I would not call port forwarding a tunnel. And you would call the connecting system a router rather than a server. – Hauke Laging May 5 '14 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.