I am struggling with this problem and I just can't figure it out. I am using cloud servers and I got a private network from them with ip's 10.99.x.x and netmask 255.255.0.0
I have 2 servers:
Server A: eth0:Public IP eth1:10.99.0.10 (DHCP server)
Server B:
br0 Link encap:Ethernet HWaddr 5a:00:00:17:77:9d
inet addr:10.99.0.13 Bcast:10.99.0.255 Mask:255.255.0.0
inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14372 errors:0 dropped:0 overruns:0 frame:0
TX packets:13790 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1499616 (1.4 MiB) TX bytes:2504080 (2.3 MiB)
eth0 Link encap:Ethernet HWaddr 56:00:00:17:77:9d
inet addr:publicip Bcast:publicip.255 Mask:255.255.255.0
inet6 addr: public Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:43554 errors:0 dropped:0 overruns:0 frame:0
TX packets:42546 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6842717 (6.5 MiB) TX bytes:6795158 (6.4 MiB)
eth1 Link encap:Ethernet HWaddr 5a:00:00:17:77:9d
inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:61 errors:0 dropped:0 overruns:0 frame:0
TX packets:126 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10634 (10.3 KiB) TX bytes:14772 (14.4 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tap0 Link encap:Ethernet HWaddr ba:41:3e:54:37:72
inet6 addr: fe80::b841:3eff:fe54:3772/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:14345 errors:0 dropped:0 overruns:0 frame:0
TX packets:13915 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1696767 (1.6 MiB) TX bytes:2511654 (2.3 MiB)
If I run the command:
dhcpclient br0
I get an ip assigned from the DHCP server from Server A
OPENVPN running in bridged mode on server B, config:
port 443
proto tcp
dev tap0
server-bridge 10.99.0.13 255.255.0.0 10.99.0.100 10.99.0.150
To bring up the bridge:
#!/bin/bash
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="10.99.0.13"
eth_netmask="255.255.0.0"
eth_broadcast="10.99.0.255"
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route table server B:
Destination Gateway Genmask Flags Metric Ref Use Iface
default publicip.1 0.0.0.0 UG 0 0 0 eth0
10.99.0.0 * 255.255.0.0 U 0 0 0 br0
publicip.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
I am connecting to server B with openvpn and I want that all my traffic goes out like this:
VPN client ==> Server B (VPN server) ==> eth1 ==> Server A ==> eth0 ==> internet.
VPN client:
ping 10.99.0.10
PING 10.99.0.10 (10.99.0.10): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
^C
--- 10.99.0.10 ping statistics ---
11 packets transmitted, 0 packets received, 100.0% packet loss
Server B br0 tcpdump:
12:43:18.301205 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:19.280906 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:22.597505 ARP, Request who-has 10.99.0.10 tell 10.99.0.13, length 28
12:43:22.599695 ARP, Reply 10.99.0.10 is-at 5a:00:00:17:d0:80 (oui Unknown), length 28
12:43:27.317572 ARP, Request who-has 10.99.0.100 tell 10.99.0.13, length 28
12:43:27.321143 ARP, Reply 10.99.0.100 is-at 66:25:94:15:72:63 (oui Unknown), length 28
When I am connecting now I get an IP 10.99.0.100 and I can access the internet. But I can't ping 10.99.0.10.
My questions:
- How can I add a route that all traffic from Server B originating from the VPN server must pass through eth1 and then trough the gateway to server A to the outside world?
I tried to add and change routes but in most cases it didn't work and mostly I also lost my connectivity to connect to the VPN server from the outside world.
I hope someone can give me guidance!
Kindest Regards
bridge name bridge id STP enabled interfaces br0 8000.5a000017779d no eth1 tap0