0

Having set up a tinc VPN node properly (the vpn Connection works): I have set the following options

net.ipv4.ip_forward =  1
iptables -t nat -A POSTROUTING -o ens2 -j MASQUERADE

If I then set the route on my client

# need this rule to connect vpn after changing default GW
ip route add $VPN_PUBLIC_ADDR via $NETWORK_GATEWAY 
ip route del default
# route traffic through vpn
ip route add default via $VPN_PRIVATE_IP

I can only access hosts in the vpn -> the traffic is not being forwarded, just the vpn connection is working properly.

What am I missing? How can I analyze the cause of the problem?

EDIT: There is no firewall set on the vpn server side (as far as I can see)

iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere
ProfHase85
  • 501
  • 3
  • 6
  • 15
  • Can you ping the VPN IP after installing the new routes? – Enrico Polesel Dec 16 '18 at 17:45
  • yes, i can reach any machine inside the vpn. i.e.: The VPN has the address range 10.8.0.0/24 -> anything there is accessible – ProfHase85 Dec 16 '18 at 18:11
  • Seems like VPN routers (2nd hop and any hops further) only provide access inside VPN, filtering your packets out when they attempt to leave the VPN'ed network. – drookie Dec 17 '18 at 07:48
  • @drookie Could the cloud provider be the cause? Or how would I find out at what point my packets are being dropped? – ProfHase85 Dec 17 '18 at 13:20

1 Answers1

0

The problem was apparently in my tinc network as such:

Address = Not connectable
Subnet = 172.16.0.10/32 # Here is supposed to be the subnets tinc can route to

-----BEGIN RSA PUBLIC KEY-----
pubkey
-----END RSA PUBLIC KEY-----

Changing the subnet (see code) helped

ProfHase85
  • 501
  • 3
  • 6
  • 15