I'd like to configure IPtables on a single linux machine that enables packets to flow in and out of a VPN.Here's a small scale network of 3 nodes:v1 : A linux machine inside the VPN. VPN Subnet is 10.10.100.0/22out1 : A linux machine outside the VPN. It has information of how many nodes exist inside the VPN and their VPN IP's, but itself is not on the VPNr  : A linux machine that has iptables set up for the routing requirement. It is on the VPN and out1 can also send packets to it. Hence its on the edge. r therefore has eth0 that is on the same network as out1 and tun0 which is its vpn interfaceI have managed to have r be the next hop for all packets leaving out1, with destination 10.10.100.0/22. So packets are coming into r. The following two iptables rules on r enabled me to have out1, communicate with v1 over netcat   iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE   iptables -A FORWARD --in-interface eth0 -j ACCEPTMaybe these rules are incorrect because why would I need the MASQUERADE function?When v1 tries to ACK the packets from out1, they reach r and get dropped. I confirmed using tcpdump, that v1 sends packets destined to out1 and they hit r, but they never get to out1.How do I close the loop? I dont need to do NAT, since out1 already knows the destination IP's, I simply would like r to move packets from its eth0 to tun0 and tun0 to eth0.
Configuring IPtables to behave as a router on the edge of a VPN
iptables;routing;firewall;vpn;nat