I am currently attempting to use two openvpn clients to expose services of a server, as is already said in the title. I may be playing with powers far beyond my current comprehension, but please bear with me :-)
Outline
This is my current setup:
INTERNET eth0 | | VPN tun0
/----- perimeter-a -----\
internet clients-: :------ server
\----- perimeter-b -----/
server
is also the VPN-Server in this case. perimeter-a
and perimeter-b
are VPN-Clients.
server
has eth0 (public interface), eth1 (another public interface) and tun0 (vpn interface).
Each perimeter
has eth0 (public interface) and tun0 (vpn interface).
The Goal
The goal is for any internet client
to be able to speak with either perimeter-a
or perimeter-b
and have it look like they are being served by either of those while, in fact, you are being served by server
. Connecting to a game server (for example) on perimeter-a
and connecting to a game server on perimeter-b
will make you end up at server
everytime.
The only exception to this rule should be when perimeter-a
or perimeter-b
does not forward a corresponding port. Ports should be forwarded explicitly on either of those two machines. UDP and TCP should both be handled.
Previous Attempts
My previous attempt depended on NAT via iptables but had the problem of losing the address of the actual internet client
on server
. The address of the internet client
should be preserved - which is why I have then decided to use a VPN and primarily drive traffic from and to server
through that.
Idea and current attempt
My current attempt is using perimeter-a
and perimeter-b
as internet gateways for server
. The problem is, that I am not sure about whether or not it is possible to set this up when both perimeters
are VPN clients instead of servers.
Can I pass a packet from any of the perimeters
to server
without rewriting the packet source and then send it back to any of the perimeters
by figuring out that it came in on server
via tun0? But then I'd need to have two tun-interfaces to differ between both perimeters
, right? And then, when those packets arrive on perimeter-XY
, I'd need to have that machine rewrite the source to itself and send it to the internet client
, given that the packet came from tun0 - correct?
I'm completely lost at this point and I couldn't find anything describing my actual case. How far am I away from the solution? Am I going about it the wrong way? Is all this even possible?
In essence I am trying to build two pseudo-gateways and one machine to use them depending on where a connection came from.
Edit 1: The three servers in question are not on the same LAN - They are located in entirely different locations each.