topic Problem - Linux as VPN and Internet gateway in Operating System - Linux

Problem - Linux as VPN and Internet gateway

hamidr — Sat, 02 Apr 2011 03:26:33 GMT

Hi dear memebers.

I just set up a linux server which is acting as an internet gateway. For specific reason clients first make a vpn connection trough the internet to the linux server.
On the linux server iptables is configured for NAT.
The problem is that the internet speed becomes slower than expected.
I used windows and RAAS and the speed was realy good.
The server has only 1 NIC(eth0) and an alias interface is added to eth0. the alias is eth:0 with ip address 192.168.0.253
iptables config is as follows:

iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F

iptables -A FORWARD -d 192.168.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to MY_VALID_IP

Please Help.

Re: Problem - Linux as VPN and Internet gateway

Matti_Kurkela — Mon, 04 Apr 2011 04:16:50 GMT

Have you tested the speed of the VPN when the NAT is disabled, and vice versa?

> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to MY_VALID_IP

This looks slightly wrong: it applies SNAT to all outgoing traffic with 192.168.0.* source addresses. Even traffic that is going *to* the 192.168.0.* network will get SNATted, which probably isn't exactly what you wanted.

Try this line instead:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 \! -d 192.168.0.0/24 -j SNAT --to MY_VALID_IP

SNAT should be applied to Internet traffic only, not to traffic that is going to your internal network. This line should SNAT everything that has source address within 192.168.0.*, and destination address NOT within 192.168.0.*.

MK

Re: Problem - Linux as VPN and Internet gateway

hamidr — Mon, 04 Apr 2011 08:26:22 GMT

Thank you dear Matti but the problem still persists. I just found that even when I run an apache server and simply download a file from my server, I will get a maximum of 10KB/s. The server has 100 Mb/s of internet connectivity and my internet sepeed is about 2 Mb/s. Please help me.