Hello! I’m new to this so got not much experience and knowledge. Got a local network with 192.168.0.x/24 with some servers with RDP. Got a MT router. For VPN-access for some people outside the network i made pptp server and added users in secrets with local and remote addresses 10.10.10.x. Now when someone is connecting to network with VPN and use RDP its working fine as long as they use VPN gateway. But in that case all traffic goes through MT router. When im turning off VPN gateway use, im still able to ping local and remote addresses 10.10.10.x. and all that network 192.168.0.x becoming unavailable. As i understand the deal is in different addresses and firewall (ill post firewall rules next). Because when im giving to VPN user a 192.168.0.x remote address its working fine. But then all traffic to 192.168.0.x from VPN user goes through MT router as it gives a 255.255.255.255 subnet mask automatically. And many users got their local 192.168.0.x net, which becaming unavailable after VPN connect. So that is not my option.
Some advicing to use proxy-arp, others - to go deeper into firewall nat rules. I will be glad to any suggestions and advices.
How can i make possible for VPN users to use those RDP on some servers without VPN gateway?
Here are firewall rules. They all are standart/default:
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
log=no log-prefix=“”
2 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp log=no log-prefix=“”
3 ;;; for VPN PPTP
chain=input action=accept protocol=tcp dst-port=1723 log=no log-prefix=“”
4 ;;; for VPN
chain=input action=accept protocol=gre log=no log-prefix=“”
5 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=“”
6 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface=bridge-lan log=no log-prefix=“”
7 ;;; defconf: accept in ipsec policy
chain=forward action=accept log=no log-prefix=“” ipsec-policy=in,ipsec
8 ;;; defconf: accept out ipsec policy
chain=forward action=accept log=no log-prefix=“” ipsec-policy=out,ipsec
9 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection
connection-state=established,related log=no log-prefix=“”
10 ;;; defconf: accept established,related, untracked
chain=forward action=accept
connection-state=established,related,untracked log=no log-prefix=“”
11 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=“”
and NAT
0 chain=srcnat action=masquerade log=no log-prefix=“”
