Re: Wrong routing when combining ip rule with SNAT

[Nikolaus Rath <Nikolaus@rath.org>]

Vigneswaran R <vignesh@atc.tcs.com> writes:
> On 09/17/2013 06:28 AM, Nikolaus Rath wrote:
>> Hi Eliezer,
>>
>> I have a VPN connection, and I want to tunnel everything through the VPN
>> node -- except, of course, the VPN connection itself.
>>
>> The hard part is to also tunnel non-VPN connections to the VPN node
>> itself. In other words how do I make sure that every connection to the
>> external ip of the VPN node is tunneled through its internal ip --
>> except for the packets that form the tunnel itself?
>>
>> My idea was install a default route to the internal ip of the VPN node,
>> use iptables to mark the VPN connections and then set up a special
>> routing table for those. But maybe there's an easier way?
>
> * What is the internal IP of the VPN node? Is it 192.168.12.1 (and
> ebox is the VPN node)?
>
> * How the nodes are connected? Is it something like,
>
>    vostro <---> ebox <---> [Internet]
>
> If so, where is 192.168.17.1 located.

Ok, you asked for it. Here's my attempt at ASCII art :-).


vostro  <--[192.168.17.0/24]--> evil-nat-dpi-firewall-box
  ^                                        ^
  |                                        | 
  |                                    [Internet]      
  |                                        |
  |                                        |
  `---[192.168.12.0/24]---> ebox <---------'
  

So vostro is connected to some local network (e.g. 192.168.17.0/24, but
that changes depending on where I am) and to the VPN
(192.168.12.0/24). The local network is connected to the internet using
some (typically overly restricive) NAT box. ebox is connected to the
internet and to the VPN. I'm establishing the VPN by setting up an HTTP
tunnel through the internet to ebox.

Once the tunnel is established, I want that almost packet goes from
vostro to the internet to go through the VPN -- including packets
destined for ebox's public ip, but excluding packets that are destined
to port 80 of ebox's public ip (because they form the tunnel itself).


Best,
Nikolaus
  
-- 
Encrypted emails preferred.
PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6  02CF A9AD B7F8 AE4E 425C

             »Time flies like an arrow, fruit flies like a Banana.«