3

I am trying to set up a double VPN with openvpn 2.3.4, on two Debian 8. Say I have this 'diagram':

client -> A (vpn server 1) -> B (vpn server 2)

Interfaces:

  • on A : eth0 with public ip & tun0 10.8.0.1
  • on B : eth0 with public ip & tun0 10.8.1.1

The connections between client and A and between A and B work respectively. Also, I cannot connect to server A whenever it is connected to server vpn B.

My guess is that I need a second interface on A in order to have:

  1. client binds his network interfaces to tun0 with the vpn connection initiated with A
  2. server A has an interface eth1 that serves the server-side VPN part and connects with openvpn client to vpn server B with interface eth0
  3. server B manages the connections from A and therefore from client

My question is : am I thinking correctly here ? Except theory, I haven't found any practical explanations about configuring double VPN...

Also, would it be possible to 'split' an interface (on A) into 2 new virtual ones (eth0:0 and eth0:1 for instance) and use them as replacement of eth0 and eth1 as described before ?

Thanks for the help !

EDIT 1: To answer qasdfdsaq and make my question clearer, I want : client connects through VPN tunnel from A -> A connects through VPN tunnel to B -> B manages clients connections

In the end, client should have server B's ip on the internet.

EDIT 2: I think I could actually summarize my problem as so: A and B are Debian 8 servers, where B is running openvpn server. A has one network interface with public ip, eth0, on which I can ssh. I ssh to A and launch openvpn client.

A is correctly connected through the tunnel to B and can access the web via B but, I cannot ssh anymore to A (because I guess that all, meaning here, the only interface I have available, is bound to the VPN connection.

Is there a way to counter this ?

2
  • You need to be more clear in describing exactly what you mean by double-VPN. Is client connected to A by VPN? or B? Is A connected to B via VPN? Or does the client connect to A and B by VPN simultaneously? Or does it connect to A then VPN to B through the VPN to A?
    – noitsbecky
    Jun 24, 2015 at 13:28
  • I edited my post, hopefully it makes it clearer !
    – Bamse
    Jun 24, 2015 at 13:35

2 Answers 2

0

My guess is that I need a second interface on A in order to have:

  1. Correct. You can specify name of TUN/TAP interface by adding to VPN config file: dev tapX or dev tunX

  2. On client use: no bind option or specify other port by adding to server: port 119X and to client remote address:119X

  3. Enable ip forrward @ server 1 & 2.

  4. Setup routing, every fragment of network must be aware of subnetwork existence.

Also, would it be possible to 'split' an interface (on A) into 2 new virtual ones (eth0:0 and eth0:1 for instance) and use them as replacement of eth0 and eth1 as described before ?

I completely missed sense of this.

4
  • I am wondering if I need a second physical interface on server A: openvpn binds the only interface on A to the VPN tunnel on B and it gets then impossible to ssh to A from internet. About 'splitting' eth0 into virtual ones, I though it could help me solve this problem with one interface. Now, as you see, my understanding of the problem is quite vague and I might use terms I misunderstand completely. Thanks for the help by the way.
    – Bamse
    Jun 24, 2015 at 13:59
  • OpenVPN will bind to all interfaces (default behavior), that's why you need to use different ports (bind OpenVPN service to different ports). Jun 24, 2015 at 14:01
  • Okay, I've read your edit, I'd accomplish it like this: OpenVPN's gateway redirect @ client, source based routing @ server 1, NAT @ server 2. Jun 24, 2015 at 14:08
  • I've made a second edit. When I connect on client side with openvpn on my server A, A does not respond anymore (I can only access it via some web shell). I think this problem can be simplified to a server A going through VPN to server B and client trying simply to ssh to server A - impossible for me here.
    – Bamse
    Jun 24, 2015 at 14:39
3

I've detailed how i made a double VPN in a post here : http://www.optionull.com/2017/01/29/routing-traffic-through-openvpn-multiple-hops/

The setup I've used is:

  1. End point opens a tunnel (tun0) to server A.
  2. End point opens a tunnel (tun1) to server B within tun0.
  3. All traffic is routed through tun1 to the internet.
4
  • The link is unreacheble today.
    – 473183469
    Feb 27, 2017 at 7:57
  • Sorry for that, shouldn't be https, but http. changed in the original response.
    – yuvalb9
    Feb 28, 2017 at 9:03
  • Wow, no offence, but you made everything to make your post hard to understand. Would be nice if you will make the routing part more human readable.
    – Weirdei
    May 4, 2019 at 19:34
  • 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .