I'm trying to build a virtual machine lab, with the goal of using vpn to get into my VM lab from anywhere. This keeps my LAN clients from being exposed to the internet.
Outside world (10.9.8.2) ---> DDRWRT port forwarding ----> debian virtual machine openvpn server/gateway (enp0s8 usable address to WAN) (tun0 10.9.8.1) (problem here) (enp0s3 172.16.1.1) ----> virtual machine clients that use 172.16.1.1 as a gateway(172.16.1.x)
Right now, communicating from the WAN to the debian server and clients works great. I can ping 172.16.1.2 from 10.9.8.2 and the reverse with no problems. The only issue is my clients can't go out to the internet, in a perfect world I would split tunnel the internet completely from the openVPN process.
I installed wireshark on the gateway/openvpn server and I verified that my ping requests from the LAN clients are being forwarded straight to the tunnel, great for communication back and forth my VPN, bad for google searches.
iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_INPUT_denied: "
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 172.16.1.0/24 -i enp0s3 -o enp0s8 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.9.8.0/24 -i tun0 -o enp0s3 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.9.8.0/24 -d 172.16.1.0/24 -i tun0 -o enp0s8 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "iptables_FORWARD_denied: "
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_OUTPUT_denied: "
Is there a way to selectively forward from my LAN interface to the WAN/tunnel?
