1

I am currently attempting to use two openvpn clients to expose services of a server, as is already said in the title. I may be playing with powers far beyond my current comprehension, but please bear with me :-)

Outline

This is my current setup:

           INTERNET eth0 |          | VPN tun0

                  /----- perimeter-a -----\ 
internet clients-:                         :------ server
                  \----- perimeter-b -----/

server is also the VPN-Server in this case. perimeter-a and perimeter-b are VPN-Clients.

server has eth0 (public interface), eth1 (another public interface) and tun0 (vpn interface). Each perimeter has eth0 (public interface) and tun0 (vpn interface).

The Goal

The goal is for any internet client to be able to speak with either perimeter-a or perimeter-b and have it look like they are being served by either of those while, in fact, you are being served by server. Connecting to a game server (for example) on perimeter-a and connecting to a game server on perimeter-b will make you end up at server everytime.

The only exception to this rule should be when perimeter-a or perimeter-b does not forward a corresponding port. Ports should be forwarded explicitly on either of those two machines. UDP and TCP should both be handled.

Previous Attempts

My previous attempt depended on NAT via iptables but had the problem of losing the address of the actual internet client on server. The address of the internet client should be preserved - which is why I have then decided to use a VPN and primarily drive traffic from and to server through that.

Idea and current attempt

My current attempt is using perimeter-a and perimeter-b as internet gateways for server. The problem is, that I am not sure about whether or not it is possible to set this up when both perimeters are VPN clients instead of servers.

Can I pass a packet from any of the perimeters to server without rewriting the packet source and then send it back to any of the perimeters by figuring out that it came in on server via tun0? But then I'd need to have two tun-interfaces to differ between both perimeters, right? And then, when those packets arrive on perimeter-XY, I'd need to have that machine rewrite the source to itself and send it to the internet client, given that the packet came from tun0 - correct?

I'm completely lost at this point and I couldn't find anything describing my actual case. How far am I away from the solution? Am I going about it the wrong way? Is all this even possible?

In essence I am trying to build two pseudo-gateways and one machine to use them depending on where a connection came from.

Edit 1: The three servers in question are not on the same LAN - They are located in entirely different locations each.

2
  • If I've understood your question correctly what you're trying to achieve is addressed by the Linux Virtual Server project - linuxvirtualserver.org (but I might well be missing something). Apr 18, 2015 at 7:52
  • After reading the project page for a bit this really seems like what i am looking for :) I'd gladly accept this as an answer. Apr 18, 2015 at 12:24

1 Answer 1

0

If I've understood your question correctly what you're trying to achieve is addressed by the Linux Virtual Server project - http://linuxvirtualserver.org/. At the very least it will give you pointers to the issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .