Trouble setting up a simple SSH VPN to bypass a firewall

Question

I have a small test network composed of two LANs connected via a firewall, with Linux hosts(containers). This firewall is set up to block certain websites from being accesed from within the B LAN, and as such I want to check out ways of bypassing said firewall.

For this, I know that both A and B are SSH servers (which allow root login, tunneling etc. for testing purposes), and moreover that A has set up a NAT server so that it can look up websites and such for other hosts.

So far, I have set up B as a VPN client, and A as a VPN server, with the following command, which sets up both the tunnel and the tun interfaces on each side, with addresses A_tun0_address and B_tun0_address:

root@B:/# ssh -w 0:0 root@A \
       -o "PermitLocalCommand=yes" \
       -o "LocalCommand= ip addr add B_tun0_address/24 dev tun0 && \
       ip link set tun0 up" \
       -o "RemoteCommand=ip addr add A_tun0_address/24 dev tun0 && \
       ip link set tun0 up"```

Now, let's say that I want to access a blocked website from B1, for this I would want to use the tunnel set up on B...but how? Should I redirect traffic to B_tun0_address somehow? I do not know what should be the steps from here.

Note:

This should be the equivalent of doing dynamic port forwarding, such as ssh -4NT -D <B’s IP>:<B’s port X> <user id>@<A’s IP> from B and then using B as a socks5 proxy, but the point would be doing this only with a VPN.

Edit 1:

As per @tsc_chazz comment's, I have set up the following iptables rules on B to do a dNAT:

    iptables -t nat -A PREROUTING -s 192.168.20.0/24 ! -d 192.168.20.0/24 -j DNAT --to-destination B_run0_address
    iptables -t nat -A POSTROUTING -j MASQUERADE

Also, on A, I made it masquerade traffic too:

    iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0

And then, on B1, I set up B as the default gateway for simplicity:

    ip route del default
    route add default gw 192.168.20.99

Now, I have noticed in Wireshark that, misteriously, after setting the default route for B1, the traffic just hops from that host to the destination directly, whatever the destination. I suspect that VirtualBox may be doing funky stuff so I'm not sure if that's correct.

Example, showing a Wireshark trace for a traceroute:

Answer 1

You have a typo at the end of your first iptables rule after the edit, but I'm assuming you entered it correctly on the actual system since from the sound of the rest of it you were able to send traffic out by the end.

As for the wireshark bit I guess it would depend on where you're capturing from and what you're looking at. A screenshot or 2 might help explain that more.

Also, are you just interested in web traffic here or other protocols as well? If it's just web it might have been easier to configure B as a proxy server instead of having to do that NAT configuration.

---

EDIT

You're only seeing 1 hop because it's only 1 hop - the communication is going from B1 --> B and terminating.

This command (changed the run to tun):

iptables -t nat -A PREROUTING -s 192.168.20.0/24 ! -d 192.168.20.0/24 -j DNAT --to-destination B_tun0_address

is telling B that whenever it receives a packet from 192.168.20.0/24 going anywhere outside of 192.168.20.0/24, it should do a DNAT and change the destination to B_tun0_address, meaning B is responding to all your traceroutes and pretending to be the destination.

If you want the traffic to actually be forwarded, you'll need to undo that config line.

You should only need a POSTROUTING MASQUERADE bit to take care of hiding the real source IP behind B, which will enforce that A responds to B using the tunnel. So then as long as the default route through the VPN tunnel is preferred on B over the route that goes through the firewall (which I think it should be), everything should work.

Basically, revert these:

iptables -t nat -A PREROUTING -s 192.168.20.0/24 ! -d 192.168.20.0/24 -j DNAT --to-destination B_tun0_address
iptables -t nat -A POSTROUTING -j MASQUERADE

and do this:

iptables -t nat -A POSTROUTING -s 192.168.20.0/24 -o B_tun0 -j MASQUERADE

and you should be set.

Answer 2

There would seem to be two pieces to this. The first is that B needs to be set up to forward incoming network traffic from 192.168.20.0/24, destined for anywhere outside 192.168.20.0/24, to B_tun0_address which should then result in it being forwarded to A, and from there to the Internet. With that done, all you should need to do is set a static route in B1 that sends traffic to 192.168.20.99, if it's destined either for the specific website, or for everywhere - in which case you'd set 192.168.20.99 as the default gateway.

If B is already your default gateway for the 192,168.20.0/24 network, you will have to implement filtering rules in your firewall - you do have a firewall in B, no? - to prevent any machine except B1 from seeing anything outside the 10.8.0.0/24 network.