Добрый день,
Пытаюсь настроить роутинг для openvpn клиента сервера филиала.
Схема такова: eth0 - белый ip 192.168.1.3 eth1 - локалка 192.168.248.1 tun0 - openvpn
есть локальная сеть центрального офиса, где разные сервисы находятся, подсеть 192.168.250.0
пингую подсеть с сервера openvpn
ping -I tun0 192.168.250.20
64 bytes from 192.168.250.20: icmp_seq=1 ttl=127 time=161 ms
но пингую с eth1
ping -I eth1 192.168.250.20
From 192.168.243.1 icmp_seq=2 Destination Host Unreachable
# iptables-save
# Generated by iptables-save v1.4.7 on Mon May 19 12:17:38 2014
*nat
:PREROUTING ACCEPT [1:131]
:POSTROUTING ACCEPT [1:120]
:OUTPUT ACCEPT [2:315]
-A PREROUTING ! -d 192.168.248.0/24 -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon May 19 12:17:38 2014
# Generated by iptables-save v1.4.7 on Mon May 19 12:17:38 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [16:4023]
-A INPUT -i eth1 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 139 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 138 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 137 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 3129 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 192.168.250.0/24 -i eth1 -o tun0 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon May 19 12:17:38 2014
# route
192.168.200.4 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.200.0 192.168.200.4 255.255.255.128 UG 0 0 0 tun0
192.168.248.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.250.0 192.168.200.4 255.255.255.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1003 0 0 eth1
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
-A FORWARD -d 192.168.250.0/24 -i eth1 -o tun0 -j ACCEPT
