How do I fix my routing table to allow access of VPN clients to services on the host machine?
My OS's (OS X) routing table is preventing VPN access of the VPN server. All other connections work fine. Any fixes or workarounds would be greatly appreciated.
The basic problem is that the gateway for the OS X host (IP 10.0.1.3) is 127.0.0.1, which appears to cause packets entering from interface utun0 to be sent back on interface en0, and hence are never routed back to the VPN tunnel. The tcpdump for this failure trying to access a web server (port 80) on the VPN host looks like this. Note the pass in on utun0 and the pass out on en0, which won't be sent back into the VPN tunnel.
pass in on utun0: 10.8.0.6.62787 > 10.0.1.3.80
pass out on en0: 10.0.1.3.80 > 10.8.0.6.62787
All other hosts on the LAN use the direct interface link#4 (en0), and connections to these hosts come from interface utun0 and return on utun0. The tcpdump for a successful access a web server on another LAN device looks like this. Note the pass in on utun0 and the pass out back into the VPN tunnel on utun0.
pass in on utun0: 10.8.0.6.62743 > 10.0.1.6.80
pass out on utun0: 10.0.1.6.80 > 10.8.0.6.62743
I believe the failure accessing port 80 on the VPN host machine at 10.0.1.3 is caused by the gateway 127.0.0.1, seen in OS X's standard routing table from netstat -rn:
10.0.1/24 link#4 UCS 11 0 en0
10.0.1.1 xx:xx:xx:xx:xx:xx UHLWIir 24 54999 en0 867
10.0.1.3 127.0.0.1 UHS 12 4136502 lo0
10.0.1.6 xx:xx:xx:xx:xx:xx UHLWIi 5 97 en0 1194
10.8/24 10.8.0.2 UGSc 2 0 utun0
10.8.0.2 10.8.0.1 UH 3 0 utun0
I'm using OS X's PF to NAT everything from the VPN with this pf.conf:
vpn_net = "10.8.0/24" # utun0 interface doesn't exist at boot time
int_if = "en0"
tun_if = "utun0"
nat on $int_if inet from $vpn_net to ! $int_if -> $int_if
pass in log (all, to pflog0)
pass out log (all, to pflog0)
Then I use ifconfig and tcpdump to look at packets logged by PF:
sudo ifconfig pflog0 create
sudo tcpdump -n -e -ttt -i pflog0 \( dst 10.0.1.6 and tcp port 80 \) or \( dst net 10.8/16 \)
sudo tcpdump -n -e -ttt -i pflog0 \( dst 10.0.1.3 and tcp port 80 \) or \( src 10.0.1.3 and tcp port 80 and dst net 10.8/16 \)
Is there a way to configure the routing table so that packets sent to the host at 10.0.1.3 from utun0 return on utun0?
