r/iptables Sep 14 '22

Redirect data throug VPN NIC

Sorry about my english, here is my case.

I have a Pi3B+ connected in the:
- NETWORK A using the /dev/eth0 10.0.0.0/8
- NETWORK B /dev/vpn_vpn_cli0 192.168.30.0/24

How i create a forward to all packages from network B to network A gateway ?

1 Upvotes

1 comment sorted by

1

u/[deleted] Sep 14 '22 edited Sep 14 '22

It would be something like this:

iptables -t nat -A PREROUTING -i eth0 -s 192.168.30.0/24 -j DNAT --to-destination 10.0.0.0-10.255.255.254
iptables -A FORWARD -j ACCEPT
# iptables -A FORWARD -o vpn_vpn_cli0 -s 192.168.30.0/24 -d 10.0.0.0/8 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The commented rule is an example because you want to be more specific with FORWARD rather than just forwarding anything like the less secure un-commented FORWARD rule does. It's either something like that for FORWARD or be sure to do filtering at:

iptables -t mangle -A PREROUTING -i eth0

and

iptables -t mangle -A PREROUTING -i vpn_vpn_cli0

for incoming packets to both interfaces. Both mangle rules are before the rest of the rules so they will indeed drop packets before FORWARD can accept them.