Question

Hi,
a customer of me uses a VPN service portal (OpenVpn) for remote maintenance for his machines.

I want to replace the existing router type with the RUT240.

Every machine has the same IP-Range (192.168.10.0/24) and at the service portal a virtual IP-Range (x.x.x.0/24).

To reach the real network the router (= OpenVpn Client) set after establishing the VPN connection to the server in a script iptables like this:

iptables -t nat -D PREROUTING -d '10.255.0.0/24' -j NETMAP --to '192.168.10.0/24'
iptables -t nat -I PREROUTING -d '10.255.0.0/24' -j NETMAP --to '192.168.10.0/24'
iptables -t nat -D POSTROUTING -s '192.168.10.0/24' -j NETMAP --to '10.255.0.0/24'
iptables -t nat -I POSTROUTING -s '192.168.10.0/24' -j NETMAP --to '10.255.0.0/24'

How I solve this at the RUT240?

Thanks for your support.

KR mm76

Answer 1

Hi,

Both OpenVPN and iptables should be all the same as in your previous router. Iptables rules can be written in custom rules so they would be executed at startup, and OpenVPN configs can be just copied onto ones created by RUT240.

EB.

Comments

Hi,

thanks for info.

Are you able to "translate" the iptable in my example for RUT240.

If I enter [ iptables -t nat -D PREROUTING -d '10.255.0.0/24' -j NETMAP --to '192.168.10.0/24' ] on CLI I get the
response [ iptables: no chain/target/match by that name ] ...

Thanks in advance.

BR mm76

---

Try -A instead of -D before PREROUTING.

iptables -t nat -A PREROUTING -d '10.255.0.0/24' -j NETMAP --to '192.168.10.0/24'

---

Hi, thx this is now working!!!

I have an additional question at OpenVpn Client configuration.

I try to implement the settings like in the OpenVPN settings at the Windows-PC.

Connection will be reestablished every 50 seconds and I am NOT able to ping the VPN-server. On Windows-PC it works fine...

Here my configuration:

Thx for support!

BR mm76

---

If you're not able to ping, make sure:

• You pushed the routes to both sides of VPN.
• Firewall is not blocking the pings.
• Check the config if there's anything like gateway or some other option that might block connections from clients/server.

EB.