I am trying to share vpn connection between my network without any luck.
I do have an office with Several PC's and we share the internet connection using iptables and our DNS server we also have Mail and FTP Server. Our ISP keep changing there rules and they start blocking some port like 25, 21 and 143. so the best solution i could think of is to use vpn service with a static ip address to use instead of my ISP ip address.
I do need all my computer in my local network to be using the VPN ip address and not my ISP ip address.
my network infrastructure is like this
dsl modem
Code: Select all
10.0.0.1 255.255.255.192Code: Select all
auto lo eth0 eth1
iface lo inet loopback
#internet
iface eth0 inet static
address 10.0.0.2
netmask 255.255.255.192
gateway 10.0.0.1
#local
iface eth1 inet static
address 10.0.1.1
netmask 255.255.255.240
Code: Select all
nameserver 127.0.0.1Code: Select all
options {
directory "/var/cache/bind";
forwarders {208.67.222.222; 208.67.220.220;};
auth-nxdomain no;
allow-query { any; };
recursion no;
version "0";
listen-on-v6 { any; };
};
Code: Select all
EXTIF="eth0"
EXTIP="`/sbin/ifconfig eth0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`" #whick is 10.0.0.2
INTIF="eth1" # Enter the designation for the Internal Interface's
INTNET="10.0.1.0/28" # Enter the NETWORK address the Internal Interface is on
INTIP="10.0.1.1" # Enter the IP address of the Internal Interface
UNIVERSE="0.0.0.0/0"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
iptables -P INPUT DROP
iptables -F INPUT
iptables -P OUTPUT DROP
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -F -t nat
if [ "`iptables -L | grep drop-and-log-it`" ]; then
iptables -F drop-and-log-it
fi
iptables -X
iptables -Z
iptables -N drop-and-log-it
iptables -A drop-and-log-it -j LOG --log-level info
iptables -A drop-and-log-it -j REJECT
iptables -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
iptables -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT
iptables -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it
iptables -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -j ACCEPT
iptables -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
iptables -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
iptables -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT
iptables -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT
iptables -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it
iptables -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT
iptables -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
Cloud=10.0.1.4
Port=8080
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -i $EXTIF -o $INTIF -d $Cloud -p tcp --dport $Port -j ACCEPT
iptables -t nat -A PREROUTING -i $EXTIF -d $EXTIP -p tcp --dport $Port -j DNAT --to $Cloud
iptables -A FORWARD -j drop-and-log-it
iptables -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
here route -n output before the VPN established and after.
before
Code: Select all
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.1.0 0.0.0.0 255.255.255.240 U 0 0 0 eth1
10.0.0.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0
0.0.0.0 10.0.0.1 0.0.0.0 UG 100 0 0 eth0Code: Select all
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
174.37.222.38 10.0.0.1 255.255.255.255 UGH 0 0 0 eth0
10.0.1.0 0.0.0.0 255.255.255.240 U 0 0 0 eth1
10.0.0.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 tun0
0.0.0.0 10.10.11.1 128.0.0.0 UG 0 0 0 tun0
128.0.0.0 10.10.11.1 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 10.0.0.1 0.0.0.0 UG 1 0 0 eth0Code: Select all
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address 10.0.1.3
netmask 255.255.255.240
gateway 10.0.1.1Code: Select all
nameserver 10.0.1.1Code: Select all
address 10.0.1.x
netmask 255.255.255.240
gateway 10.0.1.1
nameserver 10.0.1.1after some google searching i was able to share the internet using this
Code: Select all
WAN=eth0
VPN=tun0
LAN=eth1
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --append FORWARD --in-interface $LAN -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface $WAN -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface $VPN -j MASQUERADE I really have no idea what should i be doing or if there is something wrong i should change, therefore if anyone could help me or point me to the right direction that would be grate.
Any help would be much appreciated.
