8. Forwarding Between Subnets

8.1. Forwarding

First of all, you need to be sure that you're allowing packets to be forwarded across your interfaces. You turn this on through the proc configuration interface. It's best to do this once at boot time, but you can also put it in the vpn-pppssh script or even create a script in the /etc/init.d/ip-up.d directory (see Section 7.2) if you want.

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/ppp1/forwarding

8.2. Gatewaying

On all computers in the subnet, you need to set up the local VPN host as the gateway to all the networks on the other side of the tunnel. This just tells the computers "if you have any packets destined for the opposite side of the VPN, send them to the local VPN host". Note that if the VPN host is already the default gateway for all the computers, then you don't need to worry about this step -- the packets will be forwarded automatically.

In the example below, my VPN host has IP address 192.168.1.1 on the local network. and IP address 192.168.3.2 on the VPN network. The VPN network, containing both the client and server VPN interfaces and all computers on the opposite side of the link, is 192.168.3.0/24. Therefore, on every local computer that I want to be able to send packets through the VPN, I need to run the following command:

# route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.1.1

Now, any packet destined for the 192.168.3.0/24 network on the local machine will be relayed to host 192.168.1.1 on the local network to be forwarded through the VPN.

8.3. Routing

There should be no need to set up custom routing -- pppd tries to do it all for you. However, if you find that pppd doesn't cover your needs, the place for your routing commands is in the vpn-pppssh script itself. To change the routing on the client, simply run route. To change the route on the server, use ssh to send those commands to the server. Here's an example:

route add -net $NET1 gw $SERVER_IFIPADDR
ssh -o Batchmode=yes $SERVER_HOSTNAME -l$SERVER_USERNAME route add -net $NET2 gw $CLIENT_IFIPADDR

8.4. Masquerading

You can even set up one or both hosts to masquerade all connections through the VPN tunnel. See the IP Masquerade HOWTO for more.

# ipchains -A forward -i ppp1 -s 192.168.0.0/24 -j MASQ

8.5. Now try it

That should be all you need to forward packets from subnets connected to the client or server to the opposite machine. May your PPP-SSH VPNs serve you quietly and reliably for many years to come.