Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am struggling with this problem and I just can't figure it out. I am using cloud servers and I got a private network from them with ip's 10.99.x.x and netmask 255.255.0.0

I have 2 servers:

Server A: eth0:Public IP eth1:10.99.0.10 (DHCP server)

Server B:

br0       Link encap:Ethernet  HWaddr 5a:00:00:17:77:9d  
      inet addr:10.99.0.13  Bcast:10.99.0.255  Mask:255.255.0.0
      inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:14372 errors:0 dropped:0 overruns:0 frame:0
      TX packets:13790 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:1499616 (1.4 MiB)  TX bytes:2504080 (2.3 MiB)

eth0      Link encap:Ethernet  HWaddr 56:00:00:17:77:9d  
          inet addr:publicip  Bcast:publicip.255  Mask:255.255.255.0
          inet6 addr: public Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:43554 errors:0 dropped:0 overruns:0 frame:0
          TX packets:42546 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6842717 (6.5 MiB)  TX bytes:6795158 (6.4 MiB)

eth1      Link encap:Ethernet  HWaddr 5a:00:00:17:77:9d  
          inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:61 errors:0 dropped:0 overruns:0 frame:0
          TX packets:126 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10634 (10.3 KiB)  TX bytes:14772 (14.4 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr ba:41:3e:54:37:72  
          inet6 addr: fe80::b841:3eff:fe54:3772/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:14345 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13915 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1696767 (1.6 MiB)  TX bytes:2511654 (2.3 MiB)

If I run the command:

dhcpclient br0

I get an ip assigned from the DHCP server from Server A

OPENVPN running in bridged mode on server B, config:

port 443 
proto tcp
dev tap0
server-bridge 10.99.0.13 255.255.0.0 10.99.0.100 10.99.0.150

To bring up the bridge:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="10.99.0.13"
eth_netmask="255.255.0.0"
eth_broadcast="10.99.0.255"

for t in $tap; do
 openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
 brctl addif $br $t
done

for t in $tap; do
 ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

route table server B:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         publicip.1      0.0.0.0         UG    0      0        0 eth0
10.99.0.0       *               255.255.0.0     U     0      0        0 br0
publicip.0      *               255.255.255.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     0      0        0 eth0

I am connecting to server B with openvpn and I want that all my traffic goes out like this:

VPN client ==> Server B (VPN server) ==> eth1 ==> Server A ==> eth0 ==> internet.

VPN client:

ping 10.99.0.10
PING 10.99.0.10 (10.99.0.10): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
^C
--- 10.99.0.10 ping statistics ---
11 packets transmitted, 0 packets received, 100.0% packet loss

Server B br0 tcpdump:

12:43:18.301205 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:19.280906 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:22.597505 ARP, Request who-has 10.99.0.10 tell 10.99.0.13, length 28
12:43:22.599695 ARP, Reply 10.99.0.10 is-at 5a:00:00:17:d0:80 (oui Unknown), length 28
12:43:27.317572 ARP, Request who-has 10.99.0.100 tell 10.99.0.13, length 28
12:43:27.321143 ARP, Reply 10.99.0.100 is-at 66:25:94:15:72:63 (oui Unknown), length 28

When I am connecting now I get an IP 10.99.0.100 and I can access the internet. But I can't ping 10.99.0.10.

My questions:

  • How can I add a route that all traffic from Server B originating from the VPN server must pass through eth1 and then trough the gateway to server A to the outside world?

I tried to add and change routes but in most cases it didn't work and mostly I also lost my connectivity to connect to the VPN server from the outside world.

I hope someone can give me guidance!

Kindest Regards

share|improve this question
    
could you post an output of brctl show after Openvpn started? – Francesco P Nov 18 '15 at 13:46
    
bridge name bridge id STP enabled interfaces br0 8000.5a000017779d no eth1 tap0 – Mr.D Nov 18 '15 at 15:51
    
I just want that my traffic from the VPN from server B goes through server A before it reaches the outside world. Is this possible? And is it also possible based on IP? – Mr.D Nov 18 '15 at 15:54

I got it to work with a tun setup and source based routing!

share|improve this answer
2  
Please give a detailed answer to help others in the future. – Sven Nov 27 '15 at 9:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.