I have to external IPv4-IPs at my VPS. I want to route one to a VPN client, OpenVPN (tun). Only one VPN-Client should use the VPN, and I want to route all traffic to my second external IP to this VPN - to get a static address for some services like mail server at home. So I have done the following things:
- VPS with two IPs (109.230.XXX.5; 109.230.XXX.6)
- First IP is used for the VPN itself and other services like webserver and icecast2
- Second IP should be routed to OpenVPN-Client
- OpenVPN listens on 109.230.XXX.5 - has internal subnet 10.8.0.0/24 on tun0
- OpenVPN client is behind NAT and has 10.8.0.6 from OpenVPN and 10.0.0.6 from my router (10.0.0.1) at home
- external IP is 217.235.XXX.32 (dynamic)
iptables on the OpenVPN server are:
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT # Allow forwarding for VPN iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE # Enable NAT for VPN iptables -t nat -A PREROUTING -d 109.230.XXX.6 -j DNAT --to-destination 10.8.0.6 # route 109.230.XXX.6 to my server.home'
If I try ping 109.230.XXX.6, tcpdump shows:
$ tcpdump -ni tun0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 17:03:07.883564 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 13, length 64 17:03:08.884923 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 14, length 64 17:03:09.886750 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 15, length 64 17:03:10.889176 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 16, length 64 17:03:11.888974 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 17, length 64
The reply is leaving over eth0 - the port connected to my home router. It looks like the following:
$ tcpdump -ni eth0 | grep reply tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 17:07:49.304936 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 1, length 64 17:07:50.302311 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 2, length 64 17:07:51.305998 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 3, length 64 17:07:52.302204 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 4, length 64
Of course, my router at home drops the packet - it is not in the NAT table. So how to configurate server and client ( - my home server), to route the address to my homeserver? I get two IPs with my VPS, and want to use one for this purpose - to don't waste IPs with don't using them.
Much thanks in advance!