2

Network Diagram

In the Network Diagram above my aim is to ping 192.168.20.20 from System A. I do not want to configure the router.

For that to happen

  1. All the traffic to 192.168.20.0/24 should be first forwarded to 10.200.8.14

  2. Then System B should have a route to 192.168.20.20.

Is there any way to add a route in System A such that to reach network 192.168.20.0/24 the default gateway is 10.200.8.14. Even if such route is added, in order to reach 10.200.8.14 we still need the default gateway 10.201.11.1.

Please suggest how can it be achieved?

2 Answers 2

2

The first thing that comes to mind is VPN over SSH. See man sshd_config and search for PermitTunnel.

First, make sure that PermitTunnel (both hosts) is enabled and that PermitRootLogin ( on systemB) is yes or without-password in /etc/ssh/sshd_config and that sshd is reloaded.

Next, login to the host 10.200.8.14 using:

# ssh -NTCf -w 0:0 10.200.8.14

The following step is to configure the interfaces with a dedicated VPN subnet (192.168.10.0 in this example):

systemA # ip link set tun0 up
systemA # ip addr add 192.168.10.10/32 peer 192.168.10.20 dev tun0

systemB # ip link set tun0 up
systemB # ip addr add 192.168.10.20/32 peer 192.168.10.10 dev tun0

Then add a route for the network behind System B:

systemA # ip route add 192.168.20.0/24 via 192.168.10.10
systemA # ping 192.168.20.20

Another approach is to use sshuttle. Install sshuttle from source or the package manager. Then run:

systemA # /usr/sbin/sshuttle -D --pidfile /tmp/sshuttle.pid --dns -r user@systemB 192.168.20.0/24

This will ask for sudo password since iptables is used to route traffic. You can alter the /etc/sudoers file using visudo to avoid asking for a password:

 systemA # visudo
 # add:
 myuser ALL=(ALL) NOPASSWD: /sbin/iptables, /usr/bin/python

Some interesting references:

https://help.ubuntu.com/community/SSH_VPN
http://sleepyhead.de/howto/?href=vpn
https://github.com/apenwarr/sshuttle
0
0

I followed your steps for VPN over SSH. But problem came with arp resolution.

After adding a route for 192.168.10.0/24.

System C : route add -net 192.168.10.0/24 p255p2

I issued following command for arp resolution

System B : sudo arp -sD 192.168.10.10 eth1 pub

Ping worked after these steps.


Are these steps necessary?

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .