NAT on VPN base on KVM

[Rafal]

Hi,

I am working on configuring NAT environment with FreeBSD which is a guest on KVM.

Here is my network configuration:

I have a FreeBSD with two virtual interfaces:
- 192.168.0.17/24 - external network on interface called vtnet1
- 100.100.100.17/24 - entry point to internal network 100.100.100.0/24; interface called vtnet0

I have tried following settings:

1. rc.conf:

gateway_enable="yes" 
pf_enable="yes" 
pf_rules="/etc/pf.conf"

2. pf.conf:

ext_if="vtnet1" 
int_if="vtnet0" 

internal_net="100.100.100.0/24"

nat on $ext_if from $internal_net to any -> ($ext_if) 

pass in quick on lo0 all 
pass out quick on lo0 all 
pass in quick on vtnet1 all 
pass out quick on vtnet1 all 
pass in quick on vtnet0 all 
pass out quick on vtnet0 all

3. sysctl.conf:

net.inet.ip.forwarding=1

With such a configuration from a host in the internal network 100.100.100.0/24

ping 8.8.8.8 - works ok
ping 192.168.0.17 works ok

telnet 192.168.0.17 22 - connection refused
(all connection tcp, udp) not working..

Do you have any idea what is missing/incorrect in aforementioned settings? What should I do to have connections established correctly?

Thank you for your support!

Rafal

 

[SirDice]

"Connection refused" typically happens when you try to connect to a closed port, i.e. there's nothing listening.

Remove this from sysctl.conf:

net.inet.ip.forwarding=1

It will be set automatically by the gateway_enable in rc.conf. There's no need to explicitly set it.

 

[Rafal]

yes, but this port is open without any firewall (is my local network (ssh))

nslookup
server 8.8.8.8
does not work - no response, all other TCP/UDP connections don't work either.
only icmp works..

 

[SirDice]

yes, but this port is open without any firewall (is my local network (ssh))

Verify if it's actually listening on that IP address. I'm betting it's only listening on one of the two IP addresses.

If routing is an issue you typically get something like "no route to host" or "destination unreachable", if the firewall is an issue you typically get a "connection timed out". Most of the time you can tell where the issue is by looking at the exact error message.