Do I need
push "redirect-gateway"
at all? I went by the flowchart which asks if "redirect-gateway" is pushed
on the client.
Okay. As requested:
1. client netstat -nr
client# netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 a.b.e.1 0.0.0.0 UG 0 0 0 em1 /* default to outside world */
10.10.16.1 10.10.16.5 255.255.255.255 UGH 0 0 0 tun0 /* can ping 10.10.16.1, server tun */
10.10.16.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 /* can NOT ping 10.10.16.5 */
a.b.c.0 10.10.16.5 255.255.255.0 UG 0 0 0 tun0
a.b.e.0 0.0.0.0 255.255.255.0 U 0 0 0 em1 /* office -> outside */
a.b.f.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 /* kvm/qemu */
client#
2. server iptables setup: All tables are clear [server does not run nat]
server# iptables -L -v
Chain INPUT (policy ACCEPT 132M packets, 42G bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 82085 packets, 6884K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 any anywhere anywhere
Chain OUTPUT (policy ACCEPT 62M packets, 234G bytes)
pkts bytes target prot opt in out source destination
server# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 842K packets, 86M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 1756K packets, 115M bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any eth0 10.11.16.0/20 anywhere
Chain OUTPUT (policy ACCEPT 1755K packets, 115M bytes)
pkts bytes target prot opt in out source destination
server#
3. I've missed that, but I'm not entirely sure how to make this work -- I'm missing something since
other-1# route add -net 10.10.16.0 gw a.b.c.2
SIOCADDRT: Invalid argument
other-1#
4. Did I mention that my setup looks like:
[server] === [colo fw/router] === {internet} === [office fw/router] === [client]
...||....
{rest-of-colo-net}
I also don't really want to push redirect-gateway to the client if I can help it, since I've need to go to the outside world AND to the VPN...
