Using Raspberry PI as OpenVPN router for Asterisk

Question

So, I've been banging my head with this for quite some time.

I have the following configuration:

• OpenVPN server, IP 1.2.3.1
• Asterisk server, connected to OpenVPN server, IP 1.2.3.3
• Raspberry PI, local interface 192.168.0.17, connected to OpenVPN IP 1.2.3.6
• IP Telephone in the same local network as Raspberry PI, local ip 192.168.0.81

Networks are configured as follows:

• Local connection on raspberry is eth0
• Raspberry has additional virtual interface eth0:1 with ip 192.168.0.91
• OpenVPN connection on raspberry is tun0
• Telephone has local ip 192.168.0.81 and gateway set to 192.168.0.91 (raspberry)

On the raspberry, iptables is as follows:

#Empty all routing tables
sudo iptables -t nat -F
sudo iptables -F

#Masquerade all traffic leaving tun0 as if coming from 1.2.3.6
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

#redirect all traffic coming from eth0:1 to tun0
sudo iptables -A FORWARD -i eth0:1 -o tun0 -j ACCEPT

#redirect all traffic coming from tun0 to eth0:1
sudo iptables -A FORWARD -i tun0 -o eth0:1 -j ACCEPT

#Modify all packets coming to tun0 to forward then to the IP telephone
sudo iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination 192.168.0.81

So, I can call and I can receive calls (I have another laptop that is connected directly to VPN server and uses Zoiper for test). I can call the telephone and from telephone and audio from telephone to laptop works, but there is no incoming audio on the telephone whatsoever.

What am I doing wrong?

UPDATE

I also tried the following

1. Phone has 192.168.200.1 / 255.255.255.0 settings, connected to raspberry which has 192.168.200.2 / 255.255.255.0 (raspberry ip is gateway to phone)

2. Raspberry pi with tun ip 10.34.87.2 (connected to wifi using wlan0, then to vpn).

3. IPTables sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT sudo iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

4. On VPN server (10.34.87.1)

route add 192.168.200.0/24 10.34.87.2

NOTE: iptables is without the masquerade. Now I managed to get traffic routed from 192.168.200.1 -> 10.34.87.1 (vpn server), but not the other way around.

Any ideas?

Answer 1

Is the masquerading a requirement? if not, as your phones have the Pi as their default gateway they can reach the Server with no additional effort, just make sure that the server can reach the phones back, add a route on the server (if necessary) for 192.168.0.0/24 (adapt it as needed) via the Pi.