I'm tinkering with web servers on Rackspace, trying to figure out if I can set up a website with public parts and also private parts that are visible only via a VPN connection.
I have 2 servers running apache, the first has a mixture of public and private sites. The second has private sites and also pptpd running as the VPN server. In both cases, the internal IPs (10.n.n.n) are exposed via DNS for the private sites.
Here's a hastily drawn diagram that should hopefully show how I've managed to rig things:
The public sites work fine. The VPN connection works fine. The private sites on server 2 work fine when connected to the VPN. What doesn't work is accessing the private sites on server 1 via the VPN. I've added a potentially misleading red arrow to the diagram showing where I think the problem is.
I can ping each server from the other on their internal addresses, and I can ping server 2 over the internet on its internal address. What I can't do is ping server 1 over the internet.
I feel that I'm naively missing some essential networking knowledge about how VPNs actually work. Can anyone see what I'm missing?
The internal IP information for the servers is:
Server 1 inet addr:10.177.129.10 Bcast:0.0.0.0 Mask:255.255.192.0 Server 2 inet addr:10.176.132.180 Bcast:0.0.0.0 Mask:255.255.192.0
I am assured by rackspace that this means they are on the same subnet
Things I have tried:
Changing the local and remote IPs in
localip 10.176.132.180 remoteip 192.168.0.234-238,192.168.0.245
localip 192.168.1.1-99 remoteip 192.168.1.100-245
localip 192.168.1.1 remoteip 192.168.1.2-245
bcrelay eth1 and
I don't know if I even need bcrelay, but it seemed like a good idea at the time.
Adding a route with
route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.176.132.180
(or 192.168.0.0, whatever the localip happens to be) or
route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
Adding assorted iptable entries, such as:
sudo iptables -t nat -A POSTROUTING -j SNAT --to-source [server 2 ext ip]
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
Add ARP table entries via script
Following suggestions found on this site, (Since I am seeting 'Cannot determine ethernet address for proxy ARP' from pptp in syslog) I added an
ip-down.local scripts that run whenever a client connects and disconnects, automatically modifying the ARP table to add this:
arp --use-device --set <client 192.168... ip address> eth0 pub
None of these things seem to work. The only difference is that sometimes I get this:
Pinging 10.177.129.10 with 32 bytes of data: Request timed out.
and sometimes I get this:
Pinging 10.177.129.10 with 32 bytes of data: Reply from <server 2 ext ip>: Destination host unreachable.
depending on what assorted options I'm trying out.
I'm painfully aware though, that of all the firewall/arp table fiddling I've done, I'm not really aware of what it is I'm doing, and that worries me. I'm also aware of an uncomfortable feeling that I must have tried everything, or that there is some magical combination of the things above that I did not try yet.