Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm tinkering with web servers on Rackspace, trying to figure out if I can set up a website with public parts and also private parts that are visible only via a VPN connection.

I have 2 servers running apache, the first has a mixture of public and private sites. The second has private sites and also pptpd running as the VPN server. In both cases, the internal IPs (10.n.n.n) are exposed via DNS for the private sites.

Here's a hastily drawn diagram that should hopefully show how I've managed to rig things:

network diagram

The public sites work fine. The VPN connection works fine. The private sites on server 2 work fine when connected to the VPN. What doesn't work is accessing the private sites on server 1 via the VPN. I've added a potentially misleading red arrow to the diagram showing where I think the problem is.

I can ping each server from the other on their internal addresses, and I can ping server 2 over the internet on its internal address. What I can't do is ping server 1 over the internet.

I feel that I'm naively missing some essential networking knowledge about how VPNs actually work. Can anyone see what I'm missing?

The internal IP information for the servers is:

Server 1
    inet addr:10.177.129.10  Bcast:0.0.0.0  Mask:255.255.192.0

Server 2
    inet addr:10.176.132.180  Bcast:0.0.0.0  Mask:255.255.192.0

I am assured by rackspace that this means they are on the same subnet


Things I have tried:

Changing the local and remote IPs in /etc/pptpd.conf

localip 10.176.132.180
remoteip 192.168.0.234-238,192.168.0.245

or

localip 192.168.1.1-99
remoteip 192.168.1.100-245

or

localip 192.168.1.1
remoteip 192.168.1.2-245

Switching on bcrelay eth1 and proxyarp in /etc/pptpd.conf

I don't know if I even need bcrelay, but it seemed like a good idea at the time.

Adding a route with

route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.176.132.180

(or 192.168.0.0, whatever the localip happens to be) or

route add -net 192.168.1.0 netmask 255.255.255.0 gw  192.168.1.1

Adding assorted iptable entries, such as:

sudo iptables -t nat -A POSTROUTING -j SNAT --to-source [server 2 ext ip]

or

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

or

sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

or

sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

Add ARP table entries via script

Following suggestions found on this site, (Since I am seeting 'Cannot determine ethernet address for proxy ARP' from pptp in syslog) I added an ip-up.local and ip-down.local scripts that run whenever a client connects and disconnects, automatically modifying the ARP table to add this:

arp --use-device --set <client 192.168... ip address> eth0 pub

None of these things seem to work. The only difference is that sometimes I get this:

Pinging 10.177.129.10 with 32 bytes of data:
Request timed out.

and sometimes I get this:

Pinging 10.177.129.10 with 32 bytes of data:
Reply from <server 2 ext ip>: Destination host unreachable.

depending on what assorted options I'm trying out.

I'm painfully aware though, that of all the firewall/arp table fiddling I've done, I'm not really aware of what it is I'm doing, and that worries me. I'm also aware of an uncomfortable feeling that I must have tried everything, or that there is some magical combination of the things above that I did not try yet.

share|improve this question
    
What type of VPN (Client / Server) are you using? –  Fergus May 5 '12 at 5:12
    
It's a pptp server on ubuntu, and a Windows 7 client –  izb May 5 '12 at 8:55

1 Answer 1

Without knowing some more about the specifics of your IP addressing, I would guess that server 1 doesn't know that your workstation should be routed to through server 2.

If you add some more detail about your IP addressing scheme, especially in relation to the IP address that the HTTP requests from your workstation appear to come from, I might be able to expand this answer.

Update: Server 1's best guess as to how to get to 192.168.0.234 is via it's default route, which is wrong. You need to add a static route to 192.168.0.0/24 via server 2 on server 1.

route add -net 192.168.0.0 netmask 255.255.255.0 gw <server2>

I'm making assumptions about the network assigned by pptpd. Also, that route won't survive a reboot, so you probably want to add the route to a configuration file. Which file and what syntax depends on your distribution.

share|improve this answer
    
I've added some information to the question –  izb May 5 '12 at 8:57
    
the HTTP requests in the server 2 access log, coming from my workstation, appear to come from 192.168.0.234, which is presumably assigned by PPTPD –  izb May 5 '12 at 9:42
    
Visiting whatismyip.com shows my IP as the public IP of server 2 –  izb May 5 '12 at 9:45
    
Unfortunately that gives the error "route: netmask 000000ff doesn't make sense with host route" when I run the route add command –  izb May 5 '12 at 18:05
    
I updated the command. See if it works right now. –  wfaulk May 6 '12 at 2:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.