We are using UFW and are trying to wrap our head around IPtable rules. We are trying to have a NAT rule on both VPN 1 and VPN 2 that contains arbitrary IP addresses to therefore route traffic to 10.0.1.71 and 10.41.0.131.
Currently test server 1 can curl test server 2 using the IP 10.0.1.234 from VPN Instance 1. We would like to have inbound NATing instead of using masquerading.
We want to use NAT as the 10.0.1.71 and 10.41.0.131 addresses are subject to change.
Our environment setup is the following:
VPN 1 and VPN 2 are both Ubuntu 20.04 instances running Libreswan.
VPN Architecture Diagram
Current UFW config for VPN 1:
*nat
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-F
-A PREROUTING -s 10.0.1.71 -p tcp --dport 7000 -j DNAT --to-destination 10.41.0.131:7000
-A POSTROUTING -s 10.0.1.71 -p tcp --dport 7000 -j SNAT --to-source 10.0.1.71
-A POSTROUTING -s 10.41.0.0/16 -o ens5 -m policy --pol ipsec --dir out -j ACCEPT
-A POSTROUTING -s 10.41.0.0/16 -o ens5 -j MASQUERADE
COMMIT
Current UFW config for VPN 2:
*nat
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-F
-A PREROUTING -s 10.41.0.131 -p tcp --dport 7000 -j DNAT --to-destination 10.0.1.71:7000
-A POSTROUTING -s 10.41.0.131 -p tcp --dport 7000 -j SNAT --to-source 10.41.0.131
-A POSTROUTING -s 10.0.0.0/16 -o ens5 -m policy --pol ipsec --dir out -j ACCEPT
-A POSTROUTING -s 10.0.0.0/16 -o ens5 -j MASQUERADE
COMMIT
