0

I am struggling with this problem and I just can't figure it out. I am using cloud servers and I got a private network from them with ip's 10.99.x.x and netmask 255.255.0.0

I have 2 servers:

Server A: eth0:Public IP eth1:10.99.0.10 (DHCP server)

Server B:

br0       Link encap:Ethernet  HWaddr 5a:00:00:17:77:9d  
      inet addr:10.99.0.13  Bcast:10.99.0.255  Mask:255.255.0.0
      inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:14372 errors:0 dropped:0 overruns:0 frame:0
      TX packets:13790 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:1499616 (1.4 MiB)  TX bytes:2504080 (2.3 MiB)

eth0      Link encap:Ethernet  HWaddr 56:00:00:17:77:9d  
          inet addr:publicip  Bcast:publicip.255  Mask:255.255.255.0
          inet6 addr: public Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:43554 errors:0 dropped:0 overruns:0 frame:0
          TX packets:42546 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6842717 (6.5 MiB)  TX bytes:6795158 (6.4 MiB)

eth1      Link encap:Ethernet  HWaddr 5a:00:00:17:77:9d  
          inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:61 errors:0 dropped:0 overruns:0 frame:0
          TX packets:126 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10634 (10.3 KiB)  TX bytes:14772 (14.4 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr ba:41:3e:54:37:72  
          inet6 addr: fe80::b841:3eff:fe54:3772/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:14345 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13915 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1696767 (1.6 MiB)  TX bytes:2511654 (2.3 MiB)

If I run the command:

dhcpclient br0

I get an ip assigned from the DHCP server from Server A

OPENVPN running in bridged mode on server B, config:

port 443 
proto tcp
dev tap0
server-bridge 10.99.0.13 255.255.0.0 10.99.0.100 10.99.0.150

To bring up the bridge:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="10.99.0.13"
eth_netmask="255.255.0.0"
eth_broadcast="10.99.0.255"

for t in $tap; do
 openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
 brctl addif $br $t
done

for t in $tap; do
 ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

route table server B:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         publicip.1      0.0.0.0         UG    0      0        0 eth0
10.99.0.0       *               255.255.0.0     U     0      0        0 br0
publicip.0      *               255.255.255.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     0      0        0 eth0

I am connecting to server B with openvpn and I want that all my traffic goes out like this:

VPN client ==> Server B (VPN server) ==> eth1 ==> Server A ==> eth0 ==> internet.

VPN client:

ping 10.99.0.10
PING 10.99.0.10 (10.99.0.10): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
^C
--- 10.99.0.10 ping statistics ---
11 packets transmitted, 0 packets received, 100.0% packet loss

Server B br0 tcpdump:

12:43:18.301205 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:19.280906 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:22.597505 ARP, Request who-has 10.99.0.10 tell 10.99.0.13, length 28
12:43:22.599695 ARP, Reply 10.99.0.10 is-at 5a:00:00:17:d0:80 (oui Unknown), length 28
12:43:27.317572 ARP, Request who-has 10.99.0.100 tell 10.99.0.13, length 28
12:43:27.321143 ARP, Reply 10.99.0.100 is-at 66:25:94:15:72:63 (oui Unknown), length 28

When I am connecting now I get an IP 10.99.0.100 and I can access the internet. But I can't ping 10.99.0.10.

My questions:

  • How can I add a route that all traffic from Server B originating from the VPN server must pass through eth1 and then trough the gateway to server A to the outside world?

I tried to add and change routes but in most cases it didn't work and mostly I also lost my connectivity to connect to the VPN server from the outside world.

I hope someone can give me guidance!

Kindest Regards

3
  • could you post an output of brctl show after Openvpn started? Nov 18, 2015 at 13:46
  • bridge name bridge id STP enabled interfaces br0 8000.5a000017779d no eth1 tap0
    – Mr.D
    Nov 18, 2015 at 15:51
  • I just want that my traffic from the VPN from server B goes through server A before it reaches the outside world. Is this possible? And is it also possible based on IP?
    – Mr.D
    Nov 18, 2015 at 15:54

1 Answer 1

0

I got it to work with a tun setup and source based routing!

1
  • 2
    Please give a detailed answer to help others in the future.
    – Sven
    Nov 27, 2015 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .