VPN Masq

VPN Masq

[Arthur Kerpician]

Hi all,
Please consider the following config:

VPN CLIENT
----------------------
External IP: 123.123.123.123
Internal VPN IP: 10.0.0.2
Default gw: 10.0.0.1

VPN SERVER
-----------------------
External IP: 231.231.231.231
Internal VPN IP: 10.0.0.1

All traffic on the VPN client is routed through the VPN server using:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ipatbles -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j REJECT //block the rest

eth0: external NIC on the server

Ok, the gw works on the client so I have internet connection on it. The 
problem occurs when an external host tries to access for example the 
http server on the client (http://123.123.123.123) or pinging the 
client. Since the default gw on the client is the vpn server, I did a 
tcpdump -i tap0 (vpn interface) on the server to display some echo 
replies on the pings. And I received (on tap0 interface) these echo 
replies which weren't routed back to the pinging host. The output was:
21:11:14.983343 123.123.123.123 > 111.111.111.111: icmp: echo reply (DF)
where 111.111.111.111 is the host from where I started to ping.
Somewere on the vpn server the packets are filtered and not sent to the 
pinging host. Same for all the connections which have as destination 
client's external IP. How can I use client's services for external 
hosts? Some tweaks on client's routing table or the server's packet 
mangling is faulty?
Thanks,
Arthur