I want to setup two IPSec tunnels using two different Google Cloud VPN gateways -- GW_IP_1 and GW_IP_2 -- with two behind-NAT routers -- R1 and R2. Something like this:

GW_IP_1 ---\                                    /--- R1
            |-- my_main_router_NAT_firewall ---|
GW_IP_2 ---/                                    \--- R2

The problem: forward UDP port 500 to specific routers (R1 and R2) based on source IP address of a gateway (GW_IP_1 and GW_IP_2).

I ended up in a strange situation: one tunnel is up and packets are matching and are forwarded correctly, but packets for the second router, R2 are not matching and it looks like they disappear somewhere.

On the main NATting router I created DNAT rules:

-t nat -A PREROUTING -p udp -s GW_IP_1 --dport 500 -j DNAT --to R1:500
-t nat -A PREROUTING -p udp -s GW_IP_2 --dport 500 -j DNAT --to R2:500

I run tcpdump on both R1 and R2. R1 got the packet and bring up the tunnel, but the R2 does not see any packets to 500. I then run tcpdump on the main_router too -- packets from both GW_IP_1 and GW_IP_2 are arriving as expected.

I spent several days fighting with the routers (Ubiquiti ER-X), etc. thinking that this is a firmware bug or something specific for this type of routers. But then I setup a simple Linux router from the start -- with two interfaces, forwarding and all rules and the result is the same -- one tunnel is up (packets are forwarded correctly) and the second router does not receive any packets.

So this is probably something more fundamental to iptables/kernel. Could someone explain?

  • Does the packet count for your second rule increase from zero (i.e. is the rule seeing any packets)? – roaima Feb 18 at 15:20
  • Is GW_IP_2 on same subnet as GW_IP_1? – DDS Feb 18 at 15:30
  • @roaima no, that is one of the problems -- I see those packets using tcpdump but they do not match. I don't understand this. #DDS these are different public addresses, they might be on a single subnet though as I think now. These are Google's IP's starting with 35.246 so the mask would be no less that 16. – Kamil Feb 18 at 15:35
  • So you have to tell the default gateway (if addresses are on different networks) to forward the packets directed to the second gateway to it. – DDS Feb 18 at 15:38
  • @DDS You asked about GW_IP_1 and GW_IP_2 -- those are independent public IP's. As for R1 and R2 they are on the same network. The main_router in the middle is doing the DNATing. – Kamil Feb 18 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.