routing to internal VPN server

[nikko]

Hello guys, I have a proxmox with virutal windows servers on a company network. On one of the Windows VMs I have installed VPN. I would like to connect from a virtual client to the subnet of the Windows Server. The windows server is listenting on port 1723. I would like to forward all the traffic that comes on port 1723 in Proxmox to the Windows VMs, which is inside the proxmox and has an internal ip like 172.16.16.2:1723. I have the following IP table, but it does not seem to work.

iptables -t nat -A PREROUTING -p tcp --dport xx.xxx.xx.xx:1723 -j DNAT --to destination 172.16.16.2:1723

VPN works properly, from a machine inside the network I can connect wothout any problems. And from the client with the VMware I can ping the proxmox. What am I missing?

 

[thheo]

Please give us the output of: ip route and iptables -L -n and iptables -L -n -t nat

 

[nikko]

Sorry for the late reply:
iproute:

172.16.16.0/24 dev vmbr1  proto kernel  scope link  src 172.16.16.1
xx.162.0.0/16 dev vmbr0  proto kernel  scope link  src xx.162.2.21    //the ip of the hypervisor
default via xx.xxx.xx.xx dev vmbr0

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  172.16.16.0/24       0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I suppose I am doing something wrong with the ittables, themselves.
VMware ==> Workstation ==> Hypervisor ==> Windows Server/Domain Controller
176.16.16.45 ==> xx.162.2.xx ==> xx.162.2.xx ==> 176.16.16.2
(client win7) ==> (comp internal)==>(company internal)==> (VPN Server)


So I am trying to connect VMware and Windows Server. On the Vm Ware I have installed a VPN connection to connect to the hypervisor on port 1723. Question is how to make proxmox listen on 1723 (or some other port) and redirect to the windows server, so that I can join VMware Client to the domain of the windows server.
Thank you for your help in advance!

 

[nikko]

When I change some rules in etc/network/interfaces and restart the connection, I do not see any changes happening. Is it correct to just write the IP tables rule in the interfaces file like my example in the first post?

 

[diaolin]

You forgot to nat and dnat even proto 47

iptables -t nat -A PREROUTING -p gre -d xx.xxx.xx.xx -j DNAT --to destination 172.16.16.2

DIaolin

 

[nikko]

It is still not connecting, the iptables look like this:

 post-up echo 1 > /proc/sys/net/ipv4/ip_forward
 iptables -t nat -A POSTROUTING -s '172.16.16.1/24' -o eth0 -j MASQUERADE
 iptables -t nat -A POSTROUTING -s '172.16.16.1/24' -o vmbr0 -j MASQUERADE
 iptables -t nat -A PREROUTING -p gre -d xx.xxx.x.xx -j DNAT --to destination 172.16.16.2
 iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 1723 -j DNAT --to 172.16.16.2:1723

and the rest of the interface looks like this

auto lo
iface lo inet loopback

iface eth0 inet manual

iface eth1 inet manual

auto vmbr0
iface vmbr0 inet static
    address  xx.xxx.x.xx
    netmask  255.255.0.0
    gateway  xx.xxx.x.xx
    bridge_ports eth0
    bridge_stp off
    bridge_fd 0       

auto vmbr1
iface vmbr1 inet static
    address  172.16.16.1
    netmask  255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

any idea what could be the problem?

 

[diaolin]

Remove this:
iptables -t nat -A POSTROUTING -s '172.16.16.1/24' -o eth0 -j MASQUERADE

and add
iptables -t nat -A POSTROUTING -p gre -s '172.16.16.1/24' -o vmbr0 -j MASQUERADE

 

[harpnet]

auto vmbr1
iface vmbr1 inet static
address 172.16.16.1
netmask 255.255.255.0
bridge_ports eth1
bridge_stp off
bridge_fd 0

Had same problem a year ago, and bridging with eth1 worked. Try this setting for vmbr1 > bridge_ports eth1

 

[diaolin]

Yeah, of course

i didn't see it!

This is true.

In your config vmbr1 is a mute bridge

 

[nikko]

eht1 is the second card and it is not physically connected with the network and not active in the proxmox interface. Nevertheless I tried changing both bridge_ports to eth1, and after that eth0. It is still not conecting. At some point the error message changed from 807, which says basically can not find host.
As it is possible that the company firewall blocks the vpn, I think that I should have to test it somehow in order to se sure that this is not a windows or vmware problem. I can ping the host address from the virtual client but how could i ping the virtuall server ?

 

[diaolin]

it cannot work, the two bridges don't speak one to another...

 

[nikko]

I connected them. On both bridges the same NIC, this would be eth0. No idea what else I could do or how could make any more test, there are so many points of error by this connection.

 

[diaolin]

why?????


this is simply strange

Connect the two vm to the same bridge and you are ok

 

[nikko]

But the two VMs are not on the hypervisor. The second one is inside my computer. Here is a picture of the whole idea, i probabbly did not explained it right from the beginning.

http://www.administrator.de/images/content/82c2a7ece0292a749ad7a591ee3f44a7.jpg

 

[diaolin]

a bridge is a simple, SIMPLE, hub
if the two vm can see the bridge indipendently from the lan position
right or left inside hypervisor or outside no problem:

ONLY ON THE SAME BRIDGE

 

[nikko]

a bridge is a simple, SIMPLE, hub
if the two vm can see the bridge indipendently from the lan position
right or left inside hypervisor or outside no problem:

ONLY ON THE SAME BRIDGE

Unfortunately direct connection to one bridge is not possible. I am not allowed to mess with the company network. I only have a server with virtual machines and client with virtual clients. I can make changes only to the debian or the virtual machines, but not with the physical network. Anyway, thank you for trying to help