Dtyjlui

I would like some assistance setting up Softether on a locally bridged network with NAT, as well help getting the ip tables rules setup. I have 2 network interfaces with Ubuntu 18.04 LTS. I would like to ensure that I can get access through softether VPN software into the server which is acting as a gateway and VPN hub.

First Off, ensure that you are using Softether's Local Bridge function, and utilizing the tap interface. This will be faster than the standard bridge, and will allow you to setup DHCP in a way that doesn't break things for your other clients. :-)

I have named my TAP interface 'soft' for ease of use, but remember to adjust your netplan rules as listed below:
In the rules below I have used enp0s7 as the WAN, and enp3s0f0 as the LAN interface.

# This file is generated from information provided by

# the datasource.  Changes to it will not persist across an instance.

# To disable cloud-init's network configuration capabilities, write a file

# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:

# network: {config: disabled}

network:

    ethernets:

        enp0s7:

            dhcp4: true

            optional: false

        enp3s0f0:

            addresses: [192.168.254.1/24]

            nameservers:

                addresses: [9.9.9.9,192.168.1.254]

                search: [vinceworks.com]

            dhcp4: false

            optional: true

        tap_soft:

            addresses: [192.168.253.1/24]

            dhcp4: false

            optional: true



    version: 2

You will also need to adjust your DHCP rules in the /etc/dhcp/dhcpd.conf file:

subnet 192.168.254.0 netmask 255.255.255.0 {

  range 192.168.254.100 192.168.254.150;

# broadcast-address needs to be .255 to cover all the address range

  option broadcast-address 192.168.254.255;

  option routers 192.168.254.1;

}



subnet 192.168.253.0 netmask 255.255.255.0 {

  range 192.168.253.30 192.168.253.42;

# broadcast-address needs to be .255 to cover all the address ranges

  option broadcast-address 192.168.253.255;

  option routers 192.168.253.1;

}

Here are the iptables rules you should setup on boot:

# Default policy to drop all incoming packets.

iptables -P INPUT DROP

iptables -P FORWARD DROP

# Allow forwarding at the highest levels!

sudo sysctl -w net.ipv4.ip_forward=1



# Accept incoming packets from localhost and the LAN interface.

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i enp3s0f0 -j ACCEPT

# Accept incoming packets from tap_soft

iptables -A INPUT -i tap_soft -j ACCEPT



# Accept incoming packets from the WAN if the router initiated the

#connection

iptables -A INPUT -i enp0s7 -m conntrack 

--ctstate ESTABLISHED,RELATED -j ACCEPT



# Forward LAN packets to the WAN.

iptables -A FORWARD -i enp3s0f0 -o enp0s7 -j ACCEPT

# Forward packets Between the LAN and WAN to VPN

iptables -A FORWARD -i tap_soft -o enp0s7 -j ACCEPT

iptables -A FORWARD -i tap_soft -o enp3s0f0 -j ACCEPT



# Forward WAN packets to the LAN if the LAN initiated the connection.

iptables -A FORWARD -i enp0s7 -o enp3s0f0 -m conntrack 

--ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i enp0s7 -o tap_soft -m conntrack 

--ctstate ESTABLISHED,RELATED -j ACCEPT



# NAT traffic going out the WAN interface.

iptables -t nat -A POSTROUTING -o enp0s7 -j MASQUERADE



#Sleep for a little bit to allow the VPN interface to come up

sleep 30

#Restart the DHCP server to begin serving for the new interface

systemctl restart isc-dhcp-server