TwitterGitHubBlog

Routing

VM as a Router

Configure traffic routing and NAT from a Windows host (192.168.0.101, eth0) through a Linux VM (192.168.0.181, eth1 bridged interface) to VPN (10.10.10.0/24, tun0).

Enable IP forwarding on Linux VM:

$ sudo sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'

Create iptables rules to do the forwarding on Linux VM:

$ sudo iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
$ sudo iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT

For the purpose of redirecting NEW connections from Linux tun0 to Windows host I can set socat on a needed port as a quick solution (actually it's not necessary for this routing task):

$ sudo socat TCP-LISTEN:1337,fork TCP:192.168.0.101:1337

Create iptables rules to do NAT on Linux VM:

$ sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE

Add a route to Linux VM on Windows host:

Cmd > route add 10.10.10.0 mask 255.255.255.0 192.168.0.181

OpenVPN Jump Server

I shall configure an intermediate OpenVPN server to serve as a jump box (1st hop) to connect to the target lab. It's helpful when the target OpenVPN server (2nd hop) doesn't allow to have multiple connections with the same common name (--duplicate-cn not set), i.e. using the same client's .ovpn profile.

OpenVPN Jump Server Scheme

Quick OpenVPN server installation:

Check OpenVPN server status:

Change server config (/etc/openvpn/server/server.conf):

Create a directory with clients' configs to push and set static IPs for clients:

For other clients /30 subnets must be used as well:

Restart OpenVPN server (tun0):

Start OpenVPN client (tun1):

Check interfaces:

Configure NAT:

Make iptables rules persistent:

Add the following directive to client's .ovpn config to ignore default gateway redirection:

Connect to tun0 as a client (example for the kali client) and manually add a route only for traffic you want to go through VPN:

Last updated