Rerouting remote users to VPN channel

Rerouting remote users to VPN channel

[Ivan Gustin]

Hi,

I have one specific routing situation that I still can't handle, so I am 
asking for some help.

I have Linux server, one eth interface and 2 DSL links. One DSL is VPN 
link to another site's Web Intranet application. VPN link itself is 
realised via DSL line and CISCO router. Local users can work with that 
application. Another DSL is Internet gateway for local users, and 
incomming channel for accessing server from outside (there is Siemens 
DSL router).

I want to provide that external remote users can connect to that server 
from Internet and use that Intranet application via another DSL and VPN 
channel.

Route table:
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use 
Iface
192.168.30.9     192.168.93.65    255.255.255.255 UGH   0      0 
0 eth0
192.168.93.64    0.0.0.0         255.255.255.192 U     0      0        0 
eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.93.122   0.0.0.0         UG    0      0        0 
eth0

...93.64/26 is LAN,
...93.65 is VPN gateway to Intranet Web server on another site,
...93.122 is Internet gateway,
...30.9 is Intranet Web server with The Application on remote site.

Local users can go to Internet and on Intranet app on remote site, and 
that works fine. I need rules that Internet users comming from public IP 
using http://mysite.dyndns.biz:myport through ...93.122 can go to 
http://192.168.30.9:80. I succesfully set forwarding on DSL router so 
incomming packets comes to server on port 'myport' (I can't 
reroute/rewrite packets on DSL router itself).

I tried with one PREROUTING rule, but I can't rewrite both source and 
destination address, so obviusly I need two rules?

Thank anyone for any help,
GI

Re: Rerouting remote users to VPN channel

[Matt Barclay]

Hi Ivan,

Yes, you need SNAT and DNAT rules.  Something like this ought to work
(note: this should be on your Internet Gateway's Firewall, otherwise
you have to forward port 80 traffic from the Gateway to your linux
server.  You are running linux on your internet gateway, right?  ;)

iptables -t mangle -A PREROUTING -d <yourPublicIP> -p tcp --dport 80
-j MARK --set-mark 80
iptables -t nat -A PREROUTING -m mark --mark 80  -j DNAT --to 192.168.30.9
iptables -A FORWARD -m mark --mark 80 -j ACCEPT
iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT --to
<firewallPrivateIP>

assumes the internet gateway has a route to 192.168.30.9

If you have to run this on a different linux machine, replace
<yourPublicIP> with <firewallPrivateIP>

If this doesn't work or doesn't make sense, be sure to post a network
diagram in your email.

Good Luck,

Matt

On 4/24/06, Ivan Gustin <ivan.gustin@pu.t-com.hr> wrote:
> Hi,
>
> I have one specific routing situation that I still can't handle, so I am
> asking for some help.
>
> I have Linux server, one eth interface and 2 DSL links. One DSL is VPN
> link to another site's Web Intranet application. VPN link itself is
> realised via DSL line and CISCO router. Local users can work with that
> application. Another DSL is Internet gateway for local users, and
> incomming channel for accessing server from outside (there is Siemens
> DSL router).
>
> I want to provide that external remote users can connect to that server
> from Internet and use that Intranet application via another DSL and VPN
> channel.
>
> Route table:
> # route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 192.168.30.9     192.168.93.65    255.255.255.255 UGH   0      0
> 0 eth0
> 192.168.93.64    0.0.0.0         255.255.255.192 U     0      0        0
> eth0
> 127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
> 0.0.0.0         192.168.93.122   0.0.0.0         UG    0      0        0
> eth0
>
> ...93.64/26 is LAN,
> ...93.65 is VPN gateway to Intranet Web server on another site,
> ...93.122 is Internet gateway,
> ...30.9 is Intranet Web server with The Application on remote site.
>
> Local users can go to Internet and on Intranet app on remote site, and
> that works fine. I need rules that Internet users comming from public IP
> using http://mysite.dyndns.biz:myport through ...93.122 can go to
> http://192.168.30.9:80. I succesfully set forwarding on DSL router so
> incomming packets comes to server on port 'myport' (I can't
> reroute/rewrite packets on DSL router itself).
>
> I tried with one PREROUTING rule, but I can't rewrite both source and
> destination address, so obviusly I need two rules?
>
> Thank anyone for any help,
> GI
>
>

Re: Rerouting remote users to VPN channel

[Ivan Gustin]

Matt Barclay:
> Yes, you need SNAT and DNAT rules.  Something like this ought to work

Thank you, Matt, for answering.

> iptables -t mangle -A PREROUTING -d <yourPublicIP> -p tcp --dport 80
> -j MARK --set-mark 80
> iptables -t nat -A PREROUTING -m mark --mark 80  -j DNAT --to 192.168.30.9
> iptables -A FORWARD -m mark --mark 80 -j ACCEPT
> iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT --to
> <firewallPrivateIP>

Yes, I set up something like this few hours ago, and it worked. But, 
unfortunately, Intranet Web application uses absolute private IP 
addresses, so that can't work. Application starts, but when user clicks 
on some option connection hangs trying to open http://192.168.30.9/.... 
:-( I can't change third-party Web app.

I don't see any other solution but setting up VPN so users have private 
routeable IP addresses.

Thanks anyway.

GI