I have the following topology: enter image description here

And I'm following the iptables rules listed on https://community.openvpn.net/openvpn/wiki/BridgingAndRouting

Here's the output of iptables -L -v

Chain INPUT (policy ACCEPT 1236 packets, 145K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 407 packets, 25288 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   eth1    192.168.0.0/24       anywhere             ctstate NEW
    0     0 ACCEPT     all  --  tun0   eth1    10.8.0.0/24          anywhere             ctstate NEW
    0     0 ACCEPT     all  --  tun0   eth0    10.8.0.0/24          192.168.0.0/24       ctstate NEW

Chain OUTPUT (policy ACCEPT 1691 packets, 230K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain LOGGING (0 references)
 pkts bytes target     prot opt in     out     source               destination

This is the output of ifconfig:

eth0      Link encap:Ethernet  HWaddr 00:90:e8:45:96:79
          inet addr:192.168.0.10  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::290:e8ff:fe45:9679/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:47251 errors:0 dropped:341 overruns:0 frame:0
          TX packets:35463 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6700218 (6.3 MiB)  TX bytes:6348389 (6.0 MiB)

eth1      Link encap:Ethernet  HWaddr 00:90:e8:45:96:7a
          inet addr:213.179.150.110  Bcast:213.179.150.111  Mask:255.255.255.248
          inet6 addr: fe80::290:e8ff:fe45:967a/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:431735 errors:0 dropped:1629 overruns:0 frame:0
          TX packets:515499 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:55214512 (52.6 MiB)  TX bytes:93401691 (89.0 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:124 errors:0 dropped:0 overruns:0 frame:0
          TX packets:124 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:12872 (12.5 KiB)  TX bytes:12872 (12.5 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:105 errors:0 dropped:0 overruns:0 frame:0
          TX packets:239 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:8100 (7.9 KiB)  TX bytes:18522 (18.0 KiB)

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         213.179.150.105 0.0.0.0         UG    0      0        0 eth1
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
213.179.150.104 0.0.0.0         255.255.255.248 U     0      0        0 eth1

I have a client running and the tunnel seems to be established, since I can ping the client's tun interface:

PING 10.8.0.2 (10.8.0.2) 56(84) bytes of data.
64 bytes from 10.8.0.2: icmp_req=8 ttl=64 time=704 ms
64 bytes from 10.8.0.2: icmp_req=9 ttl=64 time=824 ms
64 bytes from 10.8.0.2: icmp_req=10 ttl=64 time=704 ms
64 bytes from 10.8.0.2: icmp_req=11 ttl=64 time=723 ms
64 bytes from 10.8.0.2: icmp_req=12 ttl=64 time=725 ms
64 bytes from 10.8.0.2: icmp_req=13 ttl=64 time=665 ms

However I cannot ping "10.8.0.2" from eth0, i.e. 192.168.0.10:

PING 10.8.0.2 (10.8.0.2) from 192.168.0.10 eth0: 56(84) bytes of data.
From 192.168.0.10 icmp_seq=1 Destination Host Unreachable
From 192.168.0.10 icmp_seq=2 Destination Host Unreachable
From 192.168.0.10 icmp_seq=3 Destination Host Unreachable

My guess is, the ping is failing because the default gateway is not in the same subnet as eth0. But shouldn't the traffic from eth0 be forwarded to tun0? What am I missing here?

I tried adding a forwarding rule from eth0 to tun0: Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination
    0     0            all  --  eth0   tun0    anywhere             anywhere

but to no avail!

I forgot to mention:

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Here's is my NAT table:

Chain PREROUTING (policy ACCEPT 1 packets, 28 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 1 packets, 28 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    tun0    anywhere             10.8.0.0/24
    0     0 MASQUERADE  all  --  any    eth1    10.8.0.0/24          anywhere
    0     0 MASQUERADE  all  --  any    tun0    192.168.0.0/24       anywhere
  • Have you tried masquerading on tun0 as the remote end of the tunnel will probably not know about your local network topology, or route that rfc1918 address elsewhere on it's own segements. – Drav Sloan Aug 5 '15 at 13:30
  • @DravSloan Sorry forgot to add the NAT table. Please check my edit. Actually what is missing is the IP address of tun0 as a gateway for eth0. netstat shows that the gateway for eth0 is 0.0.0.0# – H_squared Aug 5 '15 at 13:51
  • But the issue is, I need the current default gw for internet access. – H_squared Aug 5 '15 at 13:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.