I'd like to configure IPtables on a single linux machine that enables packets to flow in and out of a VPN.
Here's a small scale network of 3 nodes:
- v1 : A linux machine inside the VPN. VPN Subnet is 10.10.100.0/22
- out1 : A linux machine outside the VPN. It has information of how many nodes exist inside the VPN and their VPN IP's, but itself is not on the VPN
- r : A linux machine that has iptables set up for the routing requirement. It is on the VPN and out1 can also send packets to it. Hence its on the edge. r therefore has eth0 that is on the same network as out1 and tun0 which is its vpn interface
I have managed to have r be the "next hop" for all packets leaving out1, with destination 10.10.100.0/22. So packets are coming into r. The following two iptables rules on r enabled me to have out1, communicate with v1 over netcat
iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE iptables -A FORWARD --in-interface eth0 -j ACCEPT
Maybe these rules are incorrect because why would I need the MASQUERADE function?
When v1 tries to ACK the packets from out1, they reach r and get dropped. I confirmed using tcpdump, that v1 sends packets destined to out1 and they hit r, but they never get to out1.
How do I close the loop? I dont need to do NAT, since out1 already knows the destination IP's, I simply would like r to move packets from its eth0 to tun0 and tun0 to eth0.