NAT for use with OpenVPN

[Morgan Wesström]

> Something else I just realized: You'll note the route from 10.8.0.0/24 
> <http://10.8.0.0/24> and 192.168.1.200. That's the static route I added 
> from the web interface.. Is that something you think would be needed?

Absolutely. When your VPN clients try to access the Internet, the router 
will see outgoing packets with a source address of 10.8.0.x (remember 
the tcpdump?). When the reply comes back it will have a destination 
address of 10.8.0.x and your router needs to know where to send that 
packet. Since that subnet isn't connected to any of its interfaces the 
static route tells the router where to forward the packet, in this case 
to your FreeBSD machine. Your FreeBSD machine knows where that subnet is 
and will deliver the packet to the correct client. If the static route 
is missing in your router, it will try to forward the packet to its 
default gateway which is your ISPs upstream router.

>     # iptables -t nat -L
> 
> The result is not exactly what I had expected:
> 
> # iptables -t nat -L
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> #
> 
> Looks like there *are* no natting rules. I wonder if they are using 
> something other than iptables?

With my limited knowledge of iptables I tend to agree with you on this. 
Just typical it shouldn't be that easy. However, the iptables command 
was just picked by me from a google search. It might not be the correct 
syntax.

Just out of curiosity - is tcpdump part of the Linux dist on that 
router? If it is we can see what happens to your VPN clients' pings and 
just confirm that the router doesn't do NAT on them.

/Morgan