How can I forward hostapd traffic through a PPTP VPN?

Question

I'm trying to setup my own little access point and I've got two core elements of it working.

1. The WiFi Access point is connectible. I can access a webserver on the router
2. SSH-ing into the router, I can connect to the outside internet via PPTP

Does anyone know of any way I can connect the two elements together?

Answer 1

First you need to enable IP forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Then presuming that your VPN assigns a static IP you'll need SNAT:

iptables -t nat -A POSTROUTING -o <TUNNEL INTERFACE> -j SNAT --to-source <VPN IP>

replacing and as appropriate ofc. If your VPN gives you a dynamic IP, you'll need to use MASQUERADE instead:

iptables -t nat -A POSTROUTING -o <TUNNEL INTERFACE> -j MASQUERADE

Then check that your routing table is correct with:

route -n

check that you have a line similar to this:

0.0.0.0         <VPN ENDPOINT IP>     0.0.0.0         UG    2      0        0 <VPN INTERFACE>

if it's missing, add it:

route add default gw <VPN ENDPOINT IP> dev <VPN INTERFACE>

Each distro has it's own methods of making these changes permenant/persistant, so I'd need more info to help in that regards.

Answer 2

After having installed pptpd and struggling to have my VPN connection forward any traffic when connected. I used the iptables rules from below and it worked perfectly! I didn't need LAN access in neither way so I didn't use those but the VPN Client <-> World helped a lot.

I'm sharing the rules here if someone wants them.

 # Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i ppp* -o eth0 \
     -s 10.0.0.0/24 -d 192.168.0.0/24 \
     -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i ppp* -o eth1 \
     -s 10.0.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i eth0 -o eth1 \
     -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
     -j ACCEPT

# Notice that -I is used, so when listing it (iptables -vxnL) it
# will be reversed.  This is intentional in this demonstration.

# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o eth1 \
      -s 10.0.0.0/24 -j MASQUERADE

# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o eth1 \
      -s 192.168.0.0/24 -j MASQUERADE

Of course, I assume you have already done

echo 1 > /proc/sys/net/ipv4/ip_forward