0

I have a Debian Jessie box at 192.168.1.5 connected to the router (at 192.168.1.1) running an OpenVPN client (it's actually a Pi using this setup. The only part different is that the Pi's eth0 IP is static because of the router, i.e., the Pi is using the router's DHCP).

When LAN clients are set to use 192.168.1.5 as their gateway, they are on the VPN, as intended.

What I need is to have LAN clients within 192.168.1.128/25 have all their traffic redirected to 192.168.1.5, even when their IP is set by the router's DHCP and their gateway becomes 192.168.1.1. In other words, clients within 192.168.1.128/25 should work as if their gateway was 192.168.1.5.

What's the iptables and/or route add setup the router needs to have to do this (the router runs Tomato 3.4-138)? These are the router settings:

iptables -t nat -L -n

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
WANPREROUTING  all  --  0.0.0.0/0            wan_ip
upnp       all  --  0.0.0.0/0            wan_ip

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0
SNAT       all  --  192.168.1.0/24       192.168.1.0/24       to:192.168.1.1
SNAT       all  --  172.16.1.0/24        172.16.1.0/24        to:172.16.1.1

Chain WANPREROUTING (1 references)
target     prot opt source               destination
DNAT       icmp --  0.0.0.0/0            0.0.0.0/0            to:192.168.1.1
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:192.168.1.1:443
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:2222 to:192.168.1.5:22
DNAT       all  --  0.0.0.0/0            0.0.0.0/0            to:192.168.1.4

Chain pupnp (0 references)
target     prot opt source               destination

Chain upnp (1 references)
target     prot opt source               destination
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:55355 to:192.168.1.130:55355
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:55355 to:192.168.1.130:55355
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:5353 to:192.168.1.48:5353
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:4500 to:192.168.1.48:4500

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             state INVALID
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
shlimit    tcp  --  anywhere             anywhere             tcp dpt:ssh state NEW
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

Chain FORWARD (policy DROP)
target     prot opt source               destination
           all  --  anywhere             anywhere            account: network/netmask: 192.168.1.0/255.255.255.0 name: lan
           all  --  anywhere             anywhere            account: network/netmask: 172.16.1.0/255.255.255.0 name: lan1
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             state INVALID
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
wanin      all  --  anywhere             anywhere
wanout     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
upnp       all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             SIP-Device

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain shlimit (1 references)
target     prot opt source               destination
           all  --  anywhere             anywhere             recent: SET name: shlimit side: source
DROP       all  --  anywhere             anywhere             recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source

Chain upnp (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             client-1                udp dpt:55355
ACCEPT     tcp  --  anywhere             client-1                tcp dpt:55355
ACCEPT     udp  --  anywhere             client-2          udp dpt:mdns
ACCEPT     udp  --  anywhere             client-2          udp dpt:4500

Chain wanin (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             *Pi*               tcp dpt:ssh

Chain wanout (1 references)
target     prot opt source               destination

route

(router sits behind WAN modem)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
modem.ip.0.1    *               255.255.255.255 UH    0      0        0 vlan2
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
172.16.1.0      *               255.255.255.0   U     0      0        0 br1
modem.ip.0.0    *               255.255.224.0   U     0      0        0 vlan2
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         modem.ip.0.1    0.0.0.0         UG    0      0        0 vlan2
0

You can't somehow connect both a router and the RaspPi to the same LAN segment, and expect the RaspPi to rewrite packets other clients send to the LAN. This seems to be FAQ, people try with ARP spoofing and whatnot. But networking is not intended to work this way.

The clean solution is to put everything behind the RaspPi:

Router --- [eth0] RaspPi [eth1] --- Switch +--- Client1
                                           +--- Client2
                                           +--- Client3

Basically you want to act your RaspPi as a second router. That means it needs a second LAN interface. Put a DHCP server on your router, possibly enable NAT on the RaspPi of the VPN cannot handle a subnet, and you are all set.

An alternative is to activate VPN on the router itself, if you can get root access or flash OpenWRT etc.

Another alternative is to deactive the DHCP server on your router, then you can connect the RaspPi and the Router to the same LAN segement, and need only one LAN interface on the RaspPi.

  • I don't expect the RaspPi to rewrite packets other clients send to the LAN. I expect the router to rewrite packets other clients send to the LAN. – Gaia Apr 12 '17 at 14:46
  • Also, the RaspPi only has 1 ethernet port. – Gaia Apr 12 '17 at 17:05
  • 1
    If you already have root access to the router, why don't you just disable the DHCP server, and run it on the RaspPi instead? Problem solved. And yes, I know the RaspPi has only 1 built-in ethernet port. – dirkt Apr 12 '17 at 17:06
  • And VPN on the router is slow, in addition to the fact that other things are not very configurable. See bit.ly/2otfgsU – Gaia Apr 12 '17 at 17:07
  • Running DHCP on the Pi is a good option. But in this case: A) the Pi still sits behind the router? B) How to PBR the Pi's DHCP clients to VPN only 192.168.1.128/25 ? – Gaia Apr 12 '17 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.