Dirty NAT tricks (solution)

[Tiago Cruz]

On Fri, 2006-03-03 at 16:02 -0600, Travis H. wrote:
> On 3/3/06, Tiago Cruz <tiagocruz at forumgdh.net> wrote:
> > 1-) I'm in Brazil, and my clients (is more than one) don't stay here,
> > and yes in all the world (italy, eua, germany...)
> >
> > 2-) The notebooks clients is running Window$ XP :-/
> 
> Sorry, I don't know how to do what you want then.

Some months after, I'm here back to say the solution:

I did this in my default gateway master (192.168.0.0/22) with CARP
(firewall fail over):

Firewall Rules:
==============
vpn2 = "tun0"
...
set loginterface $vpn2
...
binat on $vpn2 from 192.168.0.0/22 to any -> 192.168.8.0/22
...
pass in  on $vpn from any to any keep state
pass out on $vpn from any to any keep state

Client: Windows XP (192.168.0.0/24) with OpenVPN (10.5.0.0/24):

SO, the client need to ping the host 192.168.8.32 to get reply from
192.168.0.8.

Is working now :-)

Logs:
54. 224700 rule 26/0(match): pass in on tun0: 10.5.0.6 > 192.168.0.32:
ICMP echo request, id 1024, seq 13568, length 40

Thank you,
Hope that help somebody.

-- 
Tiago Cruz
http://linuxrapido.org