Routing between networks. Where is the mistake?

Question

linux

There are 2 geographically remote servers A (gentu) and B (fribsd). A channel (ipsec+racoon) is configured between them.
internal interface address A is 192.168.4.5
internal interface address B is 192.168.8.1
netstat -rn on A
....
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.8.0 192.168.175.2 255.255.20 0 0 tun8
192.168.175.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun8
A pings any host on network 192.168.8.0
On network 192.168.4.0 there is server B (192.168.4.2) that should have access to network 192.168.8.0
netstat - rn to B
192.168.4.0/24 link#3 U net0
192.168.4.2 link#3 UHS lo0
192.168.8.0/24 192.168.4.5 UGS net0
192.168.175.0/24 192.168.4.5 UGS net0
However, there is no ping from B to 192.198.8.1 I
suspect that the solution is on the
iptables surface of server A
#!/bin /bash
iptables -F
iptables -X
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# NAT
iptables -I FORWARD -i eth0 -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.0.0/255.255.0.0
-j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A INPUT -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow any via interface lo
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow icmp, icmp-type
iptables -A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
# Allow dns requests
iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp -m udp - -dport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
P.S.
Genta is installed on A. Before that, there was a frya where everything worked

Answer 1

You:

iptables -P FORWARD DROP
iptables -I FORWARD -i eth0 -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i eth1 -d 192.168.0.0/255.255.0.0 -j ACCEPT

And your VPS network does not live on the eth0 interface, but on tun8, judging by netstat -rn on A.
Immediately try:
If everything works, then you need to edit your rules under tunXX, which is determined dynamically when the tunnel is raised (post-up scripts get the interface, and there you can add rules to iptables)