Routing traffic between subnets with iptables

Question

I have a KVM virtual machine which is acting as a VPN gateway to a network of other virtual (and eventually physical) machines. I have my hypervisor set up with a tap for each machine and a bridge to connect them so they all share the same subnet and can communicate with each other. Now, I need the VPN gateway to forward packets from its tap interface to the rest of the network. For sake of example, let's say the VPN subnet is 192.168.15.0/24, and the virtual machine subnet is 192.168.10.0/24. The VPN gateway sits at 192.168.15.1 and an example remote computer has address 192.168.15.5. I would think that setting a static route on the remote computer with ip route add 192.168.10.0/24 via 192.168.15.1 dev <tap device> would get the packets redirected to the VPN gateway, and then having an iptables rule like iptables -A FORWARD -s 192.168.15.0/24 -d 192.168.10.0/24 -j ACCEPT on the VPN gateway would allow packets to reach their destination as long as ip_forward is enabled. I can show that packets are arriving from a remote computer to the gateway, but ping 192.168.10.5 from the remote computer returns: From 192.168.10.5 icmp_seq=1 Destination Net Unknown.

Any thoughts on how to resolve this?

Edit 1: The remote computer has an appropriate route to the gateway via the VPN.

Answer 1

I got it! The issue was with the VPN routing. The VPN was not set up in switch mode, so it was impossible to route packets which needed forwarding through the gateway. I use tinc vpn, so adding a Mode = switch to tinc.conf on the gateway and the clients did the trick!