13
4
After having spent now hours troubleshooting, trawling potential solutions on this site and others, and I am resigned to beg the advice of my betters. I am working to route all network traffic on an instance of Ubuntu over a Cisco VPN at a university. Using either the built in network manager or vpnc, I can successfully establish a connection to the VPN, and can successfully route traffic to any university IP over the VPN. However, aside of those specific IP ranges, I cannot seem to conjure any route which will successfully map all network traffic over the VPN.
So far, I've attempted:
route add -net 0.0.0.0 gw homeportal dev tun0
route add -net 0.0.0.0 tun0
route add -net 0.0.0.0 gw 128.122.252.77 dev tun0
route add -net 0.0.0.0 gw 128.122.252.77 dev eth0
iptables -A FORWARD -o tun0 -j ACCEPT iptables -A FORWARD -i tun0 -j ACCEPT iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
And many other silly, ineffective, things that I cannot remember well enough to transcribe accurately.
In addition, I've tried routing smaller IP ranges, and specific IPs, each to no avail. I'm not really sure what's going wrong, as the extent of the effects I've been able to observe are failures of name resolution, and failures to route traffic over the VPN. What am I doing wrong here?
Edit-
Here is the output of ip route show
after starting the VPN connection with VPNC:
default via 192.168.1.254 dev eth0 proto static 10.0.0.0/8 dev tun0 scope link 91.230.41.0/24 dev tun0 scope link 128.122.0.0/16 dev tun0 scope link 128.122.252.68 via 192.168.1.254 dev eth0 src 192.168.1.32 128.122.253.46 dev tun0 scope link 128.122.253.79 dev tun0 scope link 172.16.0.0/12 dev tun0 scope link 192.168.0.0/16 dev tun0 scope link 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.32 metric 1 193.175.54.0/24 dev tun0 scope link 193.205.158.0/25 dev tun0 scope link 193.206.104.0/24 dev tun0 scope link 195.113.94.0/24 dev tun0 scope link 203.126.200.0/24 dev tun0 scope link 203.174.165.128/25 dev tun0 scope link 212.219.93.0/24 dev tun0 scope link 216.165.0.0/17 dev tun0 scope link
More information-
I've successfully routed arbitrary traffic over this VPN in MS Windows via the Cisco AnyConnect client with default configuration. Here is what the routing table looks like when the AnyConnect client is working (this is a different computer behind the same router at 192.168.1.254).
IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.13 30 10.0.0.0 255.0.0.0 192.168.128.1 192.168.128.197 2 91.230.41.0 255.255.255.0 192.168.128.1 192.168.128.197 2 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 128.122.0.0 255.255.0.0 192.168.128.1 192.168.128.197 2 128.122.252.68 255.255.255.255 192.168.1.254 192.168.1.13 31 172.16.0.0 255.240.0.0 192.168.128.1 192.168.128.197 2 192.168.0.0 255.255.0.0 192.168.128.1 192.168.128.197 2 192.168.1.0 255.255.255.0 On-link 192.168.1.13 286 192.168.1.13 255.255.255.255 On-link 192.168.1.13 286 192.168.1.254 255.255.255.255 On-link 192.168.1.13 31 192.168.1.255 255.255.255.255 On-link 192.168.1.13 286 192.168.31.0 255.255.255.0 On-link 192.168.31.1 276 192.168.31.1 255.255.255.255 On-link 192.168.31.1 276 192.168.31.255 255.255.255.255 On-link 192.168.31.1 276 192.168.128.0 255.255.255.0 On-link 192.168.128.197 257 192.168.128.197 255.255.255.255 On-link 192.168.128.197 257 192.168.128.255 255.255.255.255 On-link 192.168.128.197 257 192.168.203.0 255.255.255.0 On-link 192.168.203.1 276 192.168.203.1 255.255.255.255 On-link 192.168.203.1 276 192.168.203.255 255.255.255.255 On-link 192.168.203.1 276 193.175.54.0 255.255.255.0 192.168.128.1 192.168.128.197 2 193.205.158.0 255.255.255.128 192.168.128.1 192.168.128.197 2 193.206.104.0 255.255.255.0 192.168.128.1 192.168.128.197 2 195.113.94.0 255.255.255.0 192.168.128.1 192.168.128.197 2 203.126.200.0 255.255.255.0 192.168.128.1 192.168.128.197 2 203.174.165.128 255.255.255.128 192.168.128.1 192.168.128.197 2 212.219.93.0 255.255.255.0 192.168.128.1 192.168.128.197 2 216.165.0.0 255.255.128.0 192.168.128.1 192.168.128.197 2 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.1.13 286 224.0.0.0 240.0.0.0 On-link 192.168.203.1 276 224.0.0.0 240.0.0.0 On-link 192.168.31.1 276 224.0.0.0 240.0.0.0 On-link 192.168.128.197 10000 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.1.13 286 255.255.255.255 255.255.255.255 On-link 192.168.203.1 276 255.255.255.255 255.255.255.255 On-link 192.168.31.1 276 255.255.255.255 255.255.255.255 On-link 192.168.128.197 10000 ===========================================================================
I imagine that it will be clear that network routing is quite new to me, so I would appreciate a fairly high level of verbosity in answers. – deftfyodor – 2014-08-10T08:43:57.683
1It would be helpful if you could state whether you are using any client (anyconnect?), and if you could post your routing table, thank you. – MariusMatutiae – 2014-08-10T09:32:39.783
Do so using
ip route
, by the way. – user1686 – 2014-08-10T09:35:12.1132Yes, please do not use obsolete routing commands: use ip route show for the routing table. Obsolete commands hide some of the complexities which are possible and helpful also with VPNs, let alone VLANs,... – MariusMatutiae – 2014-08-10T09:38:05.853
@grawity, @MariusMatutiae - Sure thing, I've edited the question with the command output. Thanks for mentioning the
ip route
command, I hadn't run across it before. – deftfyodor – 2014-08-10T09:45:40.783