When overriding default gateway, all traffic times out?

[lovely-xylophone]

I have a happily-working ZeroTier One setup with three nodes – one on an Oracle Cloud VPS running Ubuntu 20.04, and two in my home running Windows and iOS. Things like accessing the Windows shared folders when the iOS is away from home or reverse-proxying requests to the Ubuntu to the Windows work perfectly.

I’d like to route all Internet traffic from the latter two through the first, hiding my home IP from websites I visit. This is the one I’m having trouble with: whenever I enable the Default Route/Default Router Override setting on a client, all traffic to the Internet times out. I’ve clearly done something wrong or overlooked something, but I have no idea what it could be, and I’m not very knowledgeable about networking. I’d be hugely appreciative if anyone could offer any advice.

What I’ve done so far, following this guide on zerotier.atlassian.net:

• Added net.ipv4.ip_forward=1 to /etc/sysctl.conf and run sysctl -p.
• Added to iptables/rules.v4, before running netfilter-persistent reload, where $MY_WAN_IP is the VPS’s public static IP (result of curl ifconfig.me), 10.244.0.0/16 is the managed route with a “(LAN)” value in the ZeroTier Central dash, and enp0s3 is the default network interface (result of route | grep '^default' | grep -o '[^ ]*$'):

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp0s3 -s 10.244.0.0/16 -j SNAT --to-source $MY_WAN_IP
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
-A FORWARD -i zt+ -s 10.244.0.0/16 -d 0.0.0.0/0 -j ACCEPT
-A FORWARD -i enp0s3 -s 0.0.0.0/0 -d 10.244.0.0/0 -j ACCEPT
:OUTPUT ACCEPT [0:0]
COMMIT

• Added a managed route 0.0.0.0/0 via 10.244.184.236, the ZeroTier managed IP of the machine I want all the traffic to go through.
• Made sure Broadcast is enabled in ZeroTier Central (it was by default).

---

What might I have overlooked/what should I look at next?

Thanks to anyone who can offer any tips.

[adekker]

Start by creating a much smaller route in Zerotier via your VPS, eg to 9.9.9.9/32.
If your NAT rule works then you should be able to traceroute to 9.9.9.9 and see it passing out of the VPS, and you should be able to
nslookup example.com 9.9.9.9
and get a response.