1

I am currently setting up an environment in 2 sites. All servers are Linux based. First site is my office and second site is AWS.

I have 2 servers in AWS within a VPC with site to site VPN:

  • Web01 - 172.31.24.106 & Revproxy01 - 172.31.17.216

I have 1 server (Raspberry PI) and 1 IP Camera in the office

  • Rasberry01 - 192.168.102.1 & Camera1 - 192.168.102.79.

The Raspberry PI acts as an AP (Using hostapd and dnsmasq) and the camera connects directly to the PI via wifi (The camera does not connect to the local LAN only the raspberry PI in its own LAN)

The VPN is on Raspberry1 (IPSec Strongswan), and is configured to connect to an AWS site to site VPN at the AWS side.

With a lot of research and time I've got everything up and running:

  • 172.31.24.106 & 172.31.17.216 can ping 192.168.102.1 and
  • 192.168.102.1 can ping 172.31.24.106 & 172.31.17.216.

The Routing is set up on the AWS side so traffic destined for the 192.168.102.0/24 network is passed to 192.168.102.1

My next step is to be able to ping 192.168.102.79 from 172.31.24.106. I did a TCPDump on 192.168.102.1 and can see the packets arriving @ 192.168.102.1 when I ping 192.168.102.79 from 172.31.24.106.

I think I need to route traffic on 192.168.102.1, so that when 172.31.24.106 pings 192.168.102.79, it will be forwarded from eth0 (192.168.1.114) to wlan0 (192.168.102.1) and then onwards to the correct destination 192.168.102.79

I would eventually like to access the cameras http feed from web01 & Revproxy01

Network diagram

+-------------+              +--------------+          +----------------------+
|Raspberry1   +--------------+              |          |                      |
|             |VPN to AWS    | Office Router+-------------+   +-------------+ |
|             +--------------+              |          |  |   |             | |
|             |192.168.1.114 |              |          |  +---+172.31.24.106| |
+-------------+              +--------------+          |  |   |             | |
 WLAN |192.168.102.1                                   |  |   +-------------+ |
      |192.168.102.79                                  |  |                   |
+-------------+                                        |  |                   |
|Camera01     |                                        |  |                   |
|             |                                        |  |   +-------------+ |
|             |                                        |  |   |             | |
|             |                                        |  +---+172.31.14.216| |
+-------------+                                        |      |             | |
                                                       |      +-------------+ |
                                                       |                      |
                                                       |                      |
                                                       |     AWS VPC          |
                                                       |                      |
                                                       +----------------------+
Improve this question

1 Answer 1

Reset to default
0

It seems to me that the whole VPN stuff is not relevant to the problem. In the end this seems to be a simple routing question.

In order for Raspberry1 to (successfully) forward traffic you need this:

  1. Enable the routing function on Raspberry1 (sysctl): 

    net.ipv4.ip_forward = 1

  2. Allow forwarding in the firewall on Raspberry1 (if the firewall is active), something like: 

    iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 172.31.24.106 -d 192.168.102.79 -j ACCEPT

  3. You need either 192.168.102.1 configured as default gateway on Camera01 or SNAT on Raspberry1 so that for Camera01 the traffic seems to come from 192.168.102.1

Improve this answer
2
  • Thank you, this worked great.
    – LinuxVirgin
    Commented Jun 5, 2020 at 21:34
  • @LinuxVirgin If that solved your problem then you should accept this answer so that your question does not appear to be unanswered any more.
    – Hauke Laging
    Commented Jun 5, 2020 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .