Hello, Please help me solve problem with routing. I have problem with routing from [b]internet -> through GATEWAY2 -> to host1[/b]. Packet form internet appears on {GATEWAY1 tun0} interface, but it is not forwarded to GATEWAY1 eth1 interface. Firewall allows traffic (forward and input). I use for this CentOS 8. What am I missing? I have tunnel like this: [b]host1[/b] [10.10.0.5] [b] GWTEWAY1[/b] [LAN2 eth1(10.10.0.1/24) tun0(10.11.0.1/24)] [b]GATEWAY2[/b] [tun0 (10.11.0.2/24) eth2(publicIP)] [b]internet[/b] From host1 10.10.0.5 to GATEWAY2 tun0 packets are going and returning. From gateway2 tun0 to host1 10.10.0.5 packets are going and returning. On GATEWAY2 i have DNAT to host1(10.10.0.5). Packets are going to GATEWAY1 tun0 and than not routing to GATEWAY1 eth1. Looks like problem is on the server side routing between interfaces. [b]GATEWAY1[/b] Server.conf [code] local port 1194 proto udp4 dev tun mode server topology subnet route 10.10.0.0 255.255.255.0 route 0.0.0.0 0.0.0.0.0 client-config-dir /etc/openvpn/ccd #security keys etc.. [/code] ccd.conf [code]ifconfig-push 10.11.0.2 255.255.255.0 push "route 10.10.0.0 255.255.255.0" iroute 0.0.0.0 0.0.0.0 [/code] sysctl.conf [code]net.ipv4.ip_forward=1 [/code] ip rule [code]from all fwmark 0x6 lookup dmz[/code] ip route show table dmz [code]default via 10.11.0.2 dev tun0 10.11.0.0/24 dev tun0 10.10.0.0/24 dev eth1[/code] iptables [code]iptables -t mangle -i eth1 -j MARK --set-xmark 0x6/0xffffffff iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP iptables -A FORWARD -i tun0 -d 10.10.0.0/24 -j ACCEPT iptables -A FORWARD -i eth1 -j ACCEPT [/code] [b]GATEWAY2[/b] client.conf [code]client dev tun proto udp remote 1194 #security etc..[/code] sysctl.conf [code]net.ipv4.ip_forward=1 [/code] ip route [code]default via dev eth2 10.11.0.0/24 dev tun0 10.10.0.0/24 dev tun0[/code] iptables - I have simplified iptables a bit to show that those look like are not in the way. [code]iptables -t nat -A PREROUTING -d -p icmp -j DNAT --to-destination 10.10.0.5 iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j SNAT --to-source iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP iptables -A FORWARD -i tun0 -j ACCEPT iptables -A FORWARD -i eth1 -d 10.10.0.0/24 -o tun0 -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT [/code]

Route form internet through openvpn client to lan

johnesqq

Hello,
Please help me solve problem with routing.
I have problem with routing from internet -> through GATEWAY2 -> to host1. Packet form internet appears on {GATEWAY1 tun0} interface, but it is not forwarded to GATEWAY1 eth1 interface. Firewall allows traffic (forward and input). I use for this CentOS 8.
What am I missing?

I have tunnel like this:
host1 [10.10.0.5] <----> GWTEWAY1 [LAN2 eth1(10.10.0.1/24) <-> tun0(10.11.0.1/24)] <---------> GATEWAY2 [tun0 (10.11.0.2/24) <-> eth2(publicIP)]<-------> internet

From host1 10.10.0.5 to GATEWAY2 tun0 packets are going and returning.
From gateway2 tun0 to host1 10.10.0.5 packets are going and returning.

On GATEWAY2 i have DNAT to host1(10.10.0.5). Packets are going to GATEWAY1 tun0 and than not routing to GATEWAY1 eth1.
Looks like problem is on the server side routing between interfaces.

GATEWAY1
Server.conf

local <gateway ip>
port 1194
proto udp4
dev tun
mode server
topology subnet
route 10.10.0.0 255.255.255.0
route 0.0.0.0 0.0.0.0.0
client-config-dir /etc/openvpn/ccd
#security keys etc..

ccd.conf

ifconfig-push 10.11.0.2 255.255.255.0
push "route 10.10.0.0 255.255.255.0"
iroute 0.0.0.0 0.0.0.0

sysctl.conf

net.ipv4.ip_forward=1

ip rule

from all fwmark 0x6 lookup dmz

ip route show table dmz

default via 10.11.0.2 dev tun0
10.11.0.0/24 dev tun0
10.10.0.0/24 dev eth1

iptables

iptables -t mangle -i eth1 -j MARK --set-xmark 0x6/0xffffffff

iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -i tun0 -d 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT

GATEWAY2
client.conf

client
dev tun
proto udp
remote <public ip gw1> 1194
#security etc..

sysctl.conf

net.ipv4.ip_forward=1

ip route

default via <public ip gw2> dev eth2
10.11.0.0/24 dev tun0
10.10.0.0/24 dev tun0

iptables - I have simplified iptables a bit to show that those look like are not in the way.

iptables -t nat -A PREROUTING -d <public IP gw2> -p icmp -j DNAT --to-destination 10.10.0.5
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j SNAT --to-source <public IP gw2>

iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A FORWARD -i eth1 -d 10.10.0.0/24 -o tun0 -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT