Hi 🙂
I have an Ubuntu 16.04 Server with 2 NICs:
auto eth0
iface eth0 inet static
address 192.168.99.10
netmask 255.255.255.0
dns-nameservers 192.168.99.1
auto eth1
iface eth1 inet static
address 192.168.99.11
netmask 255.255.255.0
gateway 192.168.99.1
dns-nameservers 192.168.99.1
up route del -net 192.168.99.0/24 dev eth1
So my routing table looks like this:
default 192.168.99.1 0.0.0.0 UG 0 0 0 eth1
192.168.99.0 * 255.255.255.0 U 0 0 0 eth0
After I establish a VPN connection the table has those entries:
default 10.3.7.1 128.0.0.0 UG 0 0 0 tun0
default 192.168.99.1 0.0.0.0 UG 0 0 0 eth1
10.3.7.0 * 255.255.255.0 U 0 0 0 tun0
addr.of.vpn 192.168.99.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.3.7.1 128.0.0.0 UG 0 0 0 tun0
192.168.99.0 * 255.255.255.0 U 0 0 0 eth0
I am wondering about line 4. Why the encrypted traffic is going over eth0 (no gw, no route for external addresses). Is there an option to set the interface to eth1?
I have enabled ip forwarding and those iptables entries:
-A POSTROUTING -o tun0 -j MASQUERADE
-A FORWARD -s 192.168.99.0/24 -i eth0 -o tun0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
