I have two sites. Site 1 has a router with a public IP A.B.C.D as well as a private range 192.168.13.0/24. The router also occupies the private IP 192.168.13.1. Site 2 is a single host with a public IP X.Y.Z.W.
The problem is that site 2 is behind a firewall not under my control. As a result, site 2 can access site 1 at A.B.C.D but site 1 cannot access site 2 directly.
To work around the limitation, I configured site 2 to connect to site 1's router over an OpenVPN tunnel, and using iproute2 source policy routing to redirect traffic from the private range (except the router itself) to X.Y.Z.W to go through the tunnel. For example, I have to use the following command on the router at site 1
ip rule add from 192.168.13.32/27 to X.Y.Z.W lookup vpn
to redirect traffic from the block 192.168.13.32/27 to X.Y.Z.W to consult the routing table vpn in which the default gate is the OpenVPN endpoint. I have to use source policy routing to exclude the router (which is at 192.168.13.1), otherwise the VPN traffic would not be routed back to X.Y.Z.W correctly.
So far everything is working fine, but I'm not very happy with the source policy routing because it requires me to change the ip rule every time private range 192.168.13.0/24 is changed, or more sub-blocks is added.
I'm wondering if there is any easier way to make X.Y.Z.W available to site 1's private range without using source policy routing?
Best Answer
After Site 2 opens the VPN tunnel it should be assigned an IP, e.g. 10.10.10.2, and a route should appear on the router (acting as VPN Server) pointing to this IP.
You can use Destination NAT instead of policy routing, by matching all traffic whose destination is the public IP X.Y.Z.W, and that are incoming only from the router LAN Interface, and NATTing the destination to 10.10.10.2.
This will route all traffic going to Site 2 through the VPN tunnel automatically, and it will hit the public host.