I'd like to configure IPtables on a single linux machine that enables packets to flow in and out of a VPN.

Here's a small scale network of 3 nodes:

  1. v1 : A linux machine inside the VPN. VPN Subnet is
  2. out1 : A linux machine outside the VPN. It has information of how many nodes exist inside the VPN and their VPN IP's, but itself is not on the VPN
  3. r : A linux machine that has iptables set up for the routing requirement. It is on the VPN and out1 can also send packets to it. Hence its on the edge. r therefore has eth0 that is on the same network as out1 and tun0 which is its vpn interface

I have managed to have r be the "next hop" for all packets leaving out1, with destination So packets are coming into r. The following two iptables rules on r enabled me to have out1, communicate with v1 over netcat

   iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE
   iptables -A FORWARD --in-interface eth0 -j ACCEPT

Maybe these rules are incorrect because why would I need the MASQUERADE function?

When v1 tries to ACK the packets from out1, they reach r and get dropped. I confirmed using tcpdump, that v1 sends packets destined to out1 and they hit r, but they never get to out1.

How do I close the loop? I dont need to do NAT, since out1 already knows the destination IP's, I simply would like r to move packets from its eth0 to tun0 and tun0 to eth0.


Here's how I did it

#Forward connections coming in from eth0 to tun0
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT

#Masquerade packets leaving tun0
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

#Forward Stateful connections coming in from tun0 to eth0
iptables -A FORWARD -i tun0 -o eth0 -m state --state ESTABLISHED,RELATED \
             -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.