1

I have a bridge network br0 that has the IP 10.0.0.1/24, I have a client connected with the IP 10.0.0.2 to it. I also have a VPN connection (tun0) that has an IP assigned by an DHCP, so it's IP may vary. The VPN connection is not the default route of the system, therefore all the traffic on the device goes trough the regular eth0 route (Not the VPN one). (IPv4 forwarding is enabled on the host)

What I'm trying to achieve is that any client that is connected to br0 (In my case an LXC container) with the gateway set to 10.0.0.1 should have it's traffic NATed and routed trough the VPN connetion.

As it is not possible to directly attach the tun0 device to br0, I tried to get the traffic forwarded by using iptables.

So the steps I believe I have to take is to force the traffic from br0 get masqueraded then get forwarded to tun0 by using these commands:

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i br0 -o tun0 -j ACCEPT

I added also state tracking, but it didn't work:

iptables -A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

To add a secondary default route I added in the file " /etc/iproute2/rt_tables" a "1 vpnout" entry, and added the default route:

ip route add default dev vpn-out table vpnout

which didn't work, and the same result with the next commands

ip route add default via dev vpn-out table vpnout
ip rule add from 10.0.0.0/24 table vpnout
ip rule add to 10.0.0.0/24 table vpnout

But still after that the I still cannot ping 8.8.8.8 from the Client connected to br0. Is there something that I'm missing out?

  • There is one problem and one missing thing. The problem is: you cannot control routing with iptables, rules what you have written are simply filtering conditions (except masquerade rule). You will need those rules though. The missing thing is ip rule - you are not telling conditions when the vpnout routing table should be used. Look into this: man7.org/linux/man-pages/man8/ip-rule.8.html – Fiisch Dec 23 '18 at 20:35
1

So at the end I finally found the missing settings thanks to the suggestions of @Fiisch.

Here is the final commands to make it work:

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o br0 -j ACCEPT

iptables -A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

ip route add default dev tun0 table vpnout
ip route add 10.0.0.0/24 dev br0 table vpnout

ip rule add from 10.0.0.0/24 table vpnout
ip rule add to 10.0.0.0/24 table vpnout

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.