Re: [gentoo-user] Enable "regular" network traffic when using VPN

[Grant Taylor]

On 06/11/2018 02:51 PM, Mick wrote:
> As I understand it, the CGN router will rewrite the IP headers and ports from/
> to the SOHO router using PCP.  This is not a TCP-over-TCP tunnel.

The VPN could be TCP based and it could be sending TCP through it.  Yes, 
the potential pitfalls of TCP-in-TCP may apply.

Just because it's sub-optimal doesn't mean that it won't work.

> Outgoing connections will be OK, but to run a local server I believe you'll
> need to set up an external 'rendezvous server' to facilitate incoming
> connections, since the double NAT'ed local server will not have a public
> facing IP address.

The NATed server doesn't need a globally routed IP if there is port 
forwarding in place.  Such is possible, all be it unlikely, with 
multiple layers of NAT.

I still think the OP was talking about (multiple layers of) NAT at his 
end and connecting to a VPN server at his office that had a globally 
routed IP address.

Besides, the OP did state that he was able to connect and that traffic 
did flow bidirectionally through the VPN.

> I'm trying to recall what I was thinking when I wrote this ... SSH reverse
> tunneling?  Not sure.  Outgoing VPN connections *should* work fine, incoming
> won't.

Incoming VPN connections can be made to work.  They will require 
significantly more effort and cooperation of the NAT administrators.

Besides, this is outside of the OP's use case.

> I've tried that and couldn't get it to work - for reasons I explained below.

I've lost what your referring to there.

> Yes, in these cases you have to use different ports and set port forwarding
> per client.

Not all VPN protocols have the concept of ports and as such can't use 
different ports.



-- 
Grant. . . .
unix || die