First post.
I'll do my best to make this short and sweet.
My goal is to create a setup where a Windows client connects to a server which connects to a second server that gives access to the public internet.
That is:
WindowsClient <-> Server1 <-> Server2 <-> Internet
I have no problem doing the following:
WindowsClient <-> Server1 <-> Internet
I searched for a solution but all I could come up with were people saying it could be done without going into details. e.g.:
https://forums.openvpn.net/post16303.html?hilit=chained#p16303
So, regarding the chained setup, let's say WindowsClient<->Server1 is on the 10.8/24 network (using port 1194) and Server1<->Server2 is on the 10.9/24 network (using port 1195).
For the sake of the discussion, let's assign the following IPs to the nodes:
10.8.0.6 WindowsClient (client for 10.8/24 vpn)
10.8.0.1 Server1 (server for 10.8/24 vpn)
10.9.0.6 Server1 (client for 10.9/24 vpn)
10.9.0.1 Server2 (server for 10.9/24 vpn)
On Server1, I am using a Linux box with the following route:
10.8/24 -> 10.8.0.2
10.8.0.1 -> 10.8.0.2
10.9.0.1 -> 10.9.0.5
10.9.0.6 -> 10.9.0.5
Where 10.8.0.2 is the 10.8/24 gateway and 10.9.0.5 is the 10.9/24 gateway. Well, they are the p2p IP in the OpenVPN vpn. They are essentially the same thing than a gateway, right?
On Server2, I am using a Linux box with the following route:
10.9.0.1 -> 10.9.0.2
10.9/24 -> 10.9.0.2
Where 10.9.0.2 is the 10.9/24 gateway.
Forwarding is enabled on both boxes.
On the Server2 box, I have the following iptables rule:
iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -j SNAT --to-source <publicIP>
My problem is, on Server1, I don't know how to forward what comes from 10.8/24 through the 10.9/24 gateway.
I first tried using
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 10.9.0.5
But, logging packets with the iptables LOG target tells me the packets don't even touch the 10.9 gateway interface.
I then tried to use policy based routing (ip rule) by creating a new routing table with a single entry specifying that all trafic should be sent to the 10.9/24 gateway and redirecting packets from 10.8/24 there.
By logging the packets, I saw the packets were redirected to the 10.9 gateway interface, but that they didn't go anywhere after that.
I tried both approaches. Using a routing table for the 10.8 packets to send them to the 10.9 gateway and using a SNAT target to change the source of the packets so they would appear to come from the 10.9 interface of Server1. Doesn't work.
What am I doing wrong? What is the secret to make this work?
I tried to make this post as short as possible, so if you need more information, please ask.
Thanks !
