I have a Debian Jessie box at 192.168.1.5 connected to the router (at 192.168.1.1) running an OpenVPN client (it's actually a Pi using this setup. The only part different is that the Pi's eth0 IP is static because of the router, i.e., the Pi is using the router's DHCP).
When LAN clients are set to use 192.168.1.5 as their gateway, they are on the VPN, as intended.
What I need is to have LAN clients within 192.168.1.128/25 have all their traffic redirected to 192.168.1.5, even when their IP is set by the router's DHCP and their gateway becomes 192.168.1.1. In other words, clients within 192.168.1.128/25 should work as if their gateway was 192.168.1.5.
What's the iptables
and/or route add
setup the router needs to have to do this (the router runs Tomato 3.4-138)? These are the router settings:
iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
WANPREROUTING all -- 0.0.0.0/0 wan_ip
upnp all -- 0.0.0.0/0 wan_ip
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0
SNAT all -- 192.168.1.0/24 192.168.1.0/24 to:192.168.1.1
SNAT all -- 172.16.1.0/24 172.16.1.0/24 to:172.16.1.1
Chain WANPREROUTING (1 references)
target prot opt source destination
DNAT icmp -- 0.0.0.0/0 0.0.0.0/0 to:192.168.1.1
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.1:443
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 to:192.168.1.5:22
DNAT all -- 0.0.0.0/0 0.0.0.0/0 to:192.168.1.4
Chain pupnp (0 references)
target prot opt source destination
Chain upnp (1 references)
target prot opt source destination
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:55355 to:192.168.1.130:55355
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:55355 to:192.168.1.130:55355
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:5353 to:192.168.1.48:5353
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:4500 to:192.168.1.48:4500
iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
shlimit tcp -- anywhere anywhere tcp dpt:ssh state NEW
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:https
Chain FORWARD (policy DROP)
target prot opt source destination
all -- anywhere anywhere account: network/netmask: 192.168.1.0/255.255.255.0 name: lan
all -- anywhere anywhere account: network/netmask: 172.16.1.0/255.255.255.0 name: lan1
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
wanin all -- anywhere anywhere
wanout all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
upnp all -- anywhere anywhere
ACCEPT all -- anywhere SIP-Device
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain shlimit (1 references)
target prot opt source destination
all -- anywhere anywhere recent: SET name: shlimit side: source
DROP all -- anywhere anywhere recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source
Chain upnp (1 references)
target prot opt source destination
ACCEPT udp -- anywhere client-1 udp dpt:55355
ACCEPT tcp -- anywhere client-1 tcp dpt:55355
ACCEPT udp -- anywhere client-2 udp dpt:mdns
ACCEPT udp -- anywhere client-2 udp dpt:4500
Chain wanin (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere *Pi* tcp dpt:ssh
Chain wanout (1 references)
target prot opt source destination
route
(router sits behind WAN modem)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
modem.ip.0.1 * 255.255.255.255 UH 0 0 0 vlan2
192.168.1.0 * 255.255.255.0 U 0 0 0 br0
172.16.1.0 * 255.255.255.0 U 0 0 0 br1
modem.ip.0.0 * 255.255.224.0 U 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default modem.ip.0.1 0.0.0.0 UG 0 0 0 vlan2