3

i have a linux machine set up as a gateway between an isolated subnet and the rest of my network.

NAT is done via iptables and works fine.

# Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 2017
*filter
:INPUT ACCEPT [14459:13422943]
:FORWARD DROP [323:21689]
:OUTPUT ACCEPT [9723:3273357]
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.112.0.0/16 -d 10.113.0.0/16 -i eth0 -o eth1 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.113.0.0/16 -i eth1 -o tun0 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Mon Nov 27 10:22:22 2017
# Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 2017
*nat
:PREROUTING ACCEPT [795:105677]
:INPUT ACCEPT [20:3379]
:OUTPUT ACCEPT [12:777]
:POSTROUTING ACCEPT [12:777]
-A POSTROUTING -s 10.113.0.0/16 -o tun0 -j MASQUERADE
COMMIT
# Completed on Mon Nov 27 10:22:22 2017

If I connect via openVPN routes to redirect all traffic get pushed from the server and this also works fine.

0.0.0.0/1 via 10.211.1.142 dev tun0
default via 10.112.0.1 dev eth0 proto static
10.112.0.0/16 dev eth0 proto kernel scope link src 10.112.0.2
10.113.0.0/16 dev eth1 proto kernel scope link src 10.113.0.1
10.211.1.142 dev tun0 proto kernel scope link src 10.211.1.141
118.241.176.13 via 10.112.0.1 dev eth0
128.0.0.0/1 via 10.211.1.142 dev tun0

However I would like to only redirect the NATed traffic from the subnet 10.113.0.0 via the tun0 interface and let the gateway itself keep it's normal internet connection (for updated etc).

I thought adding route-nopull to my openvpn.conf would solve this since the traffic is redirected to tun0 by the iptable rules, but apparently this is not enough (the subnet clients cannot connect to the internet)

It seems I am only missing some simple ip route entry or something.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.