-1
|--------------|          |--------------|          |--------------|
|  computer A  |      eth0|  computer B  |          |  computer C  |internet
|  (10.5.0.2)  |----------|  (10.5.0.1)  |          |  (x.x.x.x)   |--------
|              |          |              |          |         ^    |
|              |          |     NAT |    |          |    NAT  |    |
|              |          |         ˇ    | tun0     |              |
|              |          |  (10.8.0.14) |----------|  (10.8.0.1)  |
|--------------|          |--------------|          |--------------|

Here the schematic of the network I've build.
My problem is when I try to configure the NAT in the B computer
''bash root@computerB#cat /proc/sys/net/ipv4/ip_forward 1

root@computerB# iptables-save 
*nat
:PREROUTING ACCEPT [13:1108]
:INPUT ACCEPT [10:600]
:OUTPUT ACCEPT [6708:457650]
:POSTROUTING ACCEPT [5782:389727]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
# Generated by iptables-save v1.6.0 on Sat Apr 27 23:56:29 2019
*filter
:INPUT ACCEPT [1235765:1640284761]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [759264:248481682]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
  • when I whant to ping 10.5.0.1 from computer A it's work
  • when I whant to ping 10.8.0.14 from computer A it's work
  • when I whant to ping 10.8.0.1 from computer A it's not working
    so i take my friend wireshark and start to listen on tun0 I can see packets like that

    No. time mac source destination protocol length info 285 106.310258 N/A 10.5.0.2 10.8.0.1 ICMP 84 Echo (ping) request id=0x8114, seq=0/0, ttl=63 (no response found!)

I don't understand why I get ip 10.5.0.2 on interface tun0

1 Answers1

0

As explained in the comments, you should not do NAT here. You should use just regular IP routing.

However, to fix the issue with NAT, change

-A POSTROUTING -o wlan0 -j MASQUERADE

to

-A POSTROUTING -o tun0 -j MASQUERADE

in your IPTables rules.

Tero Kilkanen
  • 34,499
  • 3
  • 38
  • 58