Something else I just realized: You'll note the route from 10.8.0.0/24
<http://10.8.0.0/24> and 192.168.1.200. That's the static route I added
from the web interface.. Is that something you think would be needed?
Absolutely. When your VPN clients try to access the Internet, the router
will see outgoing packets with a source address of 10.8.0.x (remember
the tcpdump?). When the reply comes back it will have a destination
address of 10.8.0.x and your router needs to know where to send that
packet. Since that subnet isn't connected to any of its interfaces the
static route tells the router where to forward the packet, in this case
to your FreeBSD machine. Your FreeBSD machine knows where that subnet is
and will deliver the packet to the correct client. If the static route
is missing in your router, it will try to forward the packet to its
default gateway which is your ISPs upstream router.
# iptables -t nat -L
The result is not exactly what I had expected:
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
#
Looks like there *are* no natting rules. I wonder if they are using
something other than iptables?
With my limited knowledge of iptables I tend to agree with you on this.
Just typical it shouldn't be that easy. However, the iptables command
was just picked by me from a google search. It might not be the correct
syntax.
Just out of curiosity - is tcpdump part of the Linux dist on that
router? If it is we can see what happens to your VPN clients' pings and
just confirm that the router doesn't do NAT on them.
/Morgan
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
