2

Sorry for my english.

I have 2 VirtualBox VM. One with Debian 8 and the other with Ubuntu Server 14.04 LTS. Both configured with a bridged network adapter. Both machines have the same MAC an IP address (I never use them simultaneously).

In both VM, I've installed the CheckPoint VPN Client (snx). In both I can connect to the remote VPN server without problems. When I connect with the remote server a dynamic network interface is up (tunsnx). The remote LAN address is x.x.x.x/24.

For sharing the VPN connection with the computers of my LAN, I've activated (in both VM) the IP forwarding (sysctl -w net.ipv4.ip_forward=1) and I've setted the following iptables rule:

iptables -t nat -A POSTROUTING -s y.y.y.y/24 -o tunsnx -j MASQUERADE

Also I've added a route to the x.x.x.x/0 network to all the computers i n my LAN:

route add x.x.x.x mask 255.255.255.0 y.y.y.21 (windows hosts)

y.y.y.21 is the IP of the VM and y.y.y.y/24 is my local network address. Making this I can connect to the remote server through the VM from any computer of my local network. All work fine.

I know that all the configurations that I've mentionated here are gone when I reboot the machines. Dont't worry about that.

Now I've update my two VM: from Debian 8 to Debian 9 and from Ubuntu 14.04 LTS to Ubuntu 16.04 LTS and I've repeated all the process: install snx program, activate the IP forwarding and set the iptables rules. I can connect to the remote server from the both VM without problems but I can't connect to the remote server from any other machine in my LAN.

I have make some tests. I've installed other NIC in both VM and connect them to another VM in a private network (z.z.z.z/24) and I can see that the IP forwarding and the iptables rule are OK. The IP forwarding is working between the y.y.y.y/24 and z.z.z.z/24 networks without problems but is not working between the y.y.y.y/24 and x.x.x.x/24 networks.

I've searched google for a few days a I've found nothing useful.

What am I missing?

Thanks in advance.

MadHatter
  • 78,442
  • 20
  • 178
  • 229
Pepechuga
  • 21
  • 3

1 Answers1

1

Use source nat instead, because wrong source ip goes into tunnel while masquarade: tun_ip=$(ip a | grep tunsnx | grep inet | awk '{print $2;}')

iptables -t nat -A POSTROUTING -o tunsnx -s y.y.y.y/24 -j SNAT --to $tun_ip