Linux Routing in presence of VPN - Accessing router across a firewall appliance?

Question

I don't know a lot about network routing. Hopefully this is easy.

1. I have my ISP-provided router providing IP's via DHCP on 192.168.10.0/24
2. That's connected to the "red" interface of a Nethserver (firewall appliance)
3. The Nethserver's "green" interface provides IP's via DHCP to the LAN on 192.168.100.0/24

$ ip route # on the firewall    
default via 192.168.10.1 dev em1     
192.168.10.0/24 dev em1 proto kernel scope link src 192.168.10.10    
192.168.100.0/24 dev p2p2 proto kernel scope link src 192.168.100.1  

4. The laptop on the 192.168.100.0/24 network is connected to a VPN

$ ip route # on the laptop
default via 10.8.8.1 dev tun0  proto static  metric 50 
default via 192.168.100.1 dev enp0s25  proto static  metric 100 
10.8.8.0/24 dev tun0  proto kernel  scope link  src 10.8.8.27  metric 50 
169.254.0.0/16 dev tun0  scope link  metric 1000 
192.168.100.0/24 dev enp0s25  proto kernel  scope link  src 192.168.100.10  metric 100 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1 linkdown 
209.X.Y.Z via 192.168.100.1 dev enp0s25  proto static  metric 100 

I will get that router out of there at some point, but for now I want to be able to get from my laptop to the web interface of that router at 192.168.10.1. How do I add something to the routing table to do that?

(Bonus points: A not-too-long reference that will help me understand at least the basics of network routing.)

Answer 1

Very short explanation of routing: Giving a destination address, the kernel consults the routing table(s) to find out which interface to use for the next hop. You can use ip route get 1.2.3.4 to see the results of that lookup for destination address 1.2.3.4.

You already found ip route, which is equivalent to ip route list, and you can use ip route add ... and ip route del ... to add and delete rules.

However, from your routing table, and assuming that your laptop has a default route to 192.168.100.1, everything should work. If it doesn't, it's not the routing which is at fault.

To debug this, open three terminals (one on your laptop, two on the Nethserver appliance, however you get onto this one), and do tcpdump -ni em1 and tcpdump -ni p2p2 on the Nethserver, and similar on your laptop with whatever the correct network interface is.

Then do ping 192.168.10.1 on your laptop, and watch how far the ping packets (and the response) gets. That will let you narrow down where the problem is.

For example, if you see outgoing packets on p2p2, but not on em1, the firewall doesn't allow traffic from p2p2 to em1. If you see response packets at em1, but not at p2p2, the connection tracker in the firewall which should let through answers for established connections doesn't work. And so on.

Edit

As your default route is not pointing to the Nethserver (but, in your case, to the VPN), you have to tell you laptop that it can reach the 192.168.10.0/24 via the Nethserver (and shouldn't try to reach it via the VPN).

To do that, you add (as root) a route on your laptop:

ip route add 192.168.10.0/24 via 192.168.100.1 dev enp0s25

(there are some variants of this command that will also work, experiment a bit).

So in this case open four terminal windows for the tcpdump, two on your laptop on tun0 and enp0s25.

ping away and look at where the packets go; add and delete a few routes and see what changes. Following packets is really the best way to understand networking.

Try to minimize other traffic during this; if you still have too much traffic, read up on filter rules for tcpdump (or use wireshark on the interface(s) with too much traffic; you can set filter rules in a UI with that).

Edit

Yes, you can make this setting persistent in various ways (including post-up) depending on your setup, but the most elegant way is to have the Nethserver distribute that additional route via DHCP to the 192.168.100.0/24 subnet. In that way, all machines in the subnet will receive the route, without having to explicitely configure all of them. You will likely need to edit the DHCP configuration file on the Nethserver to achieve this.

Answer 2

The issue you are having is that all traffic not destined for 192.168.100.* is going out the VPN (because you have 2 default gateways and the VPN one has a lower metric). All you need to do is add a route saying that 192.168.10.* (or even just 192.168.10.1 for tighter security ) should go out the WAN port. I would add a rule like

   route add 192.168.10.1 gw 192.168.100.1

@DirkT rule should work equally well.