Iptables – Network remapping with iptables and PPTP VPN

iptablesmasqueradenetworkingpptpvpn

I have two different networks:

  1. Home network 192.168.1.0/24
    A – Home PC (192.168.1.100)
    B – Home Router (192.168.1.1 lan ip – x.x.x.x public ip)
  2. Office network 192.168.1.0/24
    C – File Server (192.168.1.200)
    D – Office Router (192.168.1.1 lan ip – x.x.x.x public ip)

Both networks have same ip rage and cannot be changed.
I set up pptp server in D (Office Router).

I set up pptp client in A (Home PC), getting a second ip for tunnel 172.19.0.1

I want to access from A (192.168.1.100) to C (192.168.1.200) but i only can reach D because of the same ip range.

I want to masquerade or remap network 2 so i can access from A (192.168.1.100) to C (172.19.0.200) thus D router could translate ip 172.19.0.200 to 192.168.1.200.

Router D is linux based so the solution think must me set up with iptables.

Anyone could help or give a clue about how to configure this?

Best Answer

It is generally accepted that you can not form a VPN tunnel between two sites with the same network range for good reason. However, some notes and suggestions to help you along your way:

Did you typo your public IPs? 192.168.0.0/16 are private, non-routable IPs. If those are indeed the public IPs of each of your routers, then your routers are not edge devices and additional configurations will need to be made on your edge routers (possibly your modems) to forward the appropriate traffic to your routers. Your routers may also need to be able to support NAT-T with this configurations as well.

Aside from that, if I understand what you have setup so far:

Client A --(vpn)-- Router D -- Server C

Client A: 172.19.0.1/24 Router D external: ?? (see note above) Router D internal: ?? (see note above) Server C: 172.19.0.200/24 (desired)

I could see connectivity being achieved by installing a second network card into your server (assuming it doesn't already have an extra one) and setting that card up as 172.19.0.200/24, this would require you to be able to add a second network onto Router D (your criteria was that the 192.168.1.0 network would remain unchanged). Server C routing table would need to reflect that traffic destined for the 172.19.0.0/24 network should be going out that second card with the router's IP on the second network being the gateway.

It is not the cleanest solution, its really just avoids the same-network issue by creating a second network and putting the server on both networks at the same time, but it should work. You would definitely want to look into device limitations before allocating serious amount of time or funds.

EDIT Regarding OP's comment. Typically speaking, you cannot NAT incoming VPN traffic because it is still encrypted at the point of the router's firewall. VPNs work because their traffic has NONAT specified in the VPN traffic selectors. Unless your office router hardware is unique in this respect and that you can perform NAT past the firewall, then I do not believe what you want to do is possible. I apologize that I am unable to assist further.

Good luck :)

Related Topic