Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have an openVPN server with multiple external IP addresses.

I'd like to have all VPN connections (tun0 interface, and/or 10.19.88.xx IP range) to take the 2nd external IP address as 'public IP', instead of the first one.

As an example, using fictive addresses:

Deault eth0 address: 11.12.13.1 (server.domain.tld)
eth0:0 address: 11.12.13.2 (vpn.domain.tld)

All VPN connections are currently using 11.12.13.1, instead of 11.12.13.2.

Is there any way to solve this (using iptables?)

Thanks

share|improve this question
    
The server is running Debian linux (and is a virtual machine). This server is being used for testing purpose only. –  Tuinslak Oct 5 '09 at 11:43
add comment

4 Answers

up vote 0 down vote accepted

Try:

iptables -t nat -A POSTROUTING -s 10.19.88.0/24 -o eth0 -j SNAT --to 11.12.13.2

Or even better ;)

iptables -t nat -A POSTROUTING -s 10.19.88.0/24 -j SNAT --to 11.12.13.2
share|improve this answer
    
-o eth0:0 doesn't seem to be working. Only full interfaces are supported (eth0). Warning: weird character in interface `eth0:0' (No aliases, :, ! or *). –  Tuinslak Oct 5 '09 at 11:54
    
Fixed my answer :) –  rkthkr Oct 5 '09 at 12:27
    
Still not working. '-i' doesn't work with postrouting, and -o eth0 (which I already tried before ;)) still uses the 1st IP address. Thanks –  Tuinslak Oct 5 '09 at 12:35
1  
Just drop the -i tun0 then. That should fix it. –  baumgart Oct 5 '09 at 13:20
add comment

iptables -t nat -A POSTROUTING -i tun0 -j SNAT --to 11.12.13.2

The issue with rkthkr's response (besides the weird character in interface) is that it would only match packets coming in from the 10.19.88.0/24 subnet that are ALREADY going out eth0:0 and SNAT'ing them.

By using -i tun0, you're identifying packets only by what interface they come in (I assume that's the only traffic coming in from tun0), and then SNAT'ing it to the proper outgoing IP.

share|improve this answer
    
I concur fully.. –  rkthkr Oct 5 '09 at 12:29
    
iptables v1.4.2: Can't use -i with POSTROUTING :) –  Tuinslak Oct 5 '09 at 13:22
    
And leaving out -i doesn't seem to change the VPN external IP address used -- but doesn't output any errors. Not to forget, all other services still need to use 11.12.13.1 as 'main' IP. –  Tuinslak Oct 5 '09 at 13:24
    
Yeah, leaving out the -i would make everything SNAT to .2. The second iptables line in rkthkr's answer should work. –  baumgart Oct 5 '09 at 14:33
    
I'm afraid that doesn't change anything. No errors, but my external IP is still the 11.12.13.1 instead of the 11.12.13.2. I'm guessing iptable is instant, and each change doesn't require the VPN-service to restart or something? I can paste you my sample iptables config if that would be of any help. –  Tuinslak Oct 5 '09 at 17:47
show 3 more comments

same problems, iptables -t nat -A POSTROUTING -i tun0 -j SNAT --to 11.12.13.2 not wotking on debian 5

share|improve this answer
    
Make sure there is no other MASQUERADING rule in iptables. –  Tuinslak Nov 2 '09 at 11:06
add comment

You can't use "-i interface_name" with POSTROUTING.

-i interface_name --> PREROUTING (from where a packet comes)

-o interface_name --> POSTROUTING (to where a packet goes)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.