Hi all,

I have an OpenVPN server running on my Unraid 6.11.5 system.

OpenVPN is using the 172.16.92.32/28 CIDR and

my Unraid server's local IP address is 192.168.92.100. (on the 192.168.92.0/24 CIDR)

 

I would like Unraid to masquerade packets coming out from the OpenVPN clients, so I added the following in the IP tables:

 

iptables -t nat -A POSTROUTING -s 172.16.92.32/28 -o br0 -j MASQUERADE

 

However, when I set a machine to capture packets incoming from the OpenVPN clients, they are still showing as coming from the IP 172.16.92.34, and not from 192.168.92.100.

 

Do you know why ?

 

Many thanks,

OP

 

PS: I know I can add a route in my router to achieve a similar result but I want to have the option of not having a "prosumer" configurable router.

Edited February 21, 20233 yr by Opawesome

Bellow are the Unraid system's IP tables:

 

iptables -t nat -L POSTROUTING -n -v --line-numbers
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0           
2    40005 4759K LIBVIRT_PRT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
3        0     0 MASQUERADE  all  --  *      !br-cbbb49f832df  172.18.92.0/28       0.0.0.0/0           
4        0     0 MASQUERADE  all  --  *      !br-3bd25e3311ca  172.18.78.128/25     0.0.0.0/0           
5        0     0 MASQUERADE  all  --  *      !br-5a02f5b4da16  172.18.1.0/28        0.0.0.0/0           
6        0     0 MASQUERADE  all  --  *      !br-3dddbe93782f  172.18.92.128/25     0.0.0.0/0           
7        0     0 MASQUERADE  all  --  *      !br-290de52ddc5f  172.18.21.0/28       0.0.0.0/0           
8        0     0 MASQUERADE  all  --  *      !br-186a42eed74c  172.18.1.128/25      0.0.0.0/0           
9        0     0 MASQUERADE  all  --  *      !br-b706fef8052b  172.18.92.64/26      0.0.0.0/0           
10       0     0 MASQUERADE  all  --  *      !br-8e76e168fd6b  172.18.21.128/25     0.0.0.0/0           
11       0     0 MASQUERADE  all  --  *      !br-8a6ec4e64534  172.18.78.0/28       0.0.0.0/0           
12       0     0 MASQUERADE  all  --  *      br0     172.16.92.32/28     0.0.0.0/0 

 

 and ip route:

ip -4 route ls
default via 192.168.92.1 dev shim-br0 
default via 192.168.92.1 dev br0 proto dhcp src 192.168.92.100 metric 1 
172.16.92.32/28 dev tun0 proto kernel scope link src 172.16.92.33 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.18.1.0/28 dev br-5a02f5b4da16 proto kernel scope link src 172.18.1.1 linkdown 
172.18.1.128/25 dev br-186a42eed74c proto kernel scope link src 172.18.1.129 linkdown 
172.18.21.0/28 dev br-290de52ddc5f proto kernel scope link src 172.18.21.1 linkdown 
172.18.21.128/25 dev br-8e76e168fd6b proto kernel scope link src 172.18.21.129 linkdown 
172.18.78.0/28 dev br-8a6ec4e64534 proto kernel scope link src 172.18.78.1 linkdown 
172.18.78.128/25 dev br-3bd25e3311ca proto kernel scope link src 172.18.78.129 linkdown 
172.18.92.0/28 dev br-cbbb49f832df proto kernel scope link src 172.18.92.1 linkdown 
172.18.92.64/26 dev br-b706fef8052b proto kernel scope link src 172.18.92.65 linkdown 
172.18.92.128/25 dev br-3dddbe93782f proto kernel scope link src 172.18.92.129 linkdown 
192.168.1.0/24 via 172.18.1.2 dev br-5a02f5b4da16 linkdown 
192.168.92.0/25 dev shim-br0 scope link 
192.168.92.0/24 dev br0 proto dhcp scope link src 192.168.92.100 metric 1 
192.168.92.128/25 dev shim-br0 scope link 

 

Edited February 21, 20233 yr by Opawesome

Using the "-I" parameter (insert) instead of the "-A" parameter (append) in the iptables rule did not change anything.

iptables -t nat -I POSTROUTING -s 172.16.92.32/28 -o br0 -j MASQUERADE

 

nor did changing "-o br0" to "-o tun0".