I have two VPS with one on which I installed OpenVPN Access Server and vpn client on the second one. When I connect the client to the OpenVPN AS, I can't get access to apache which is installed on the client, from its public IP address. My wish is to make some services like apache and postfix available from public internet on the client server while tunneling other services installed on the machine. How can I do that ?
Here is the content of my /etc/iproute2/rt_tables
#
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
1 inet
When client disconnected, ip route show
gives :
default via <router_ip> dev <ext_if>
<netw_addr> via <router_ip> dev <ext_if>
<netw_addr> dev <ext_if> proto kernel scope link src <public_ip>
When client connected, ip route show
gives :
0.0.0.0/1 via <private_router_ip> dev <vpn_if>
default via <router_ip> dev <ext_if>
128.0.0.0/1 via <private_router_ip> dev <vpn_if>
<vpn_addr> dev <vpn_if> proto kernel scope link src <private_ip>
<vpn_server_public_ip> via <router_ip> dev <ext_if>
<netw_addr> via <router_ip> dev <ext_if>
<netw_addr> dev <ext_if> proto kernel scope link src <public_ip>
When client connected, ip addr show
gives
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: <ext_if>: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
inet <public_ip>/<netmask> brd <ext_broadcast_ip> scope global <ext_if>
valid_lft forever preferred_lft forever
inet6 XXXX:XXXX:XXXX:XXXX::XX scope global
valid_lft forever preferred_lft forever
inet6 XXXX::XX:XXXX:XXXX:XXXX/XX scope link
valid_lft forever preferred_lft forever
18: <vpn_if>: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet <private_ip>/<netmask> brd <private_broadcast_ip> scope global <vpn_if>
valid_lft forever preferred_lft forever
ip route show table inet
just do be sure its correct. I updated my answer, as it turned out that just usingMARK
on the incoming packets is not enough. The whole connection needs to be marked withCONNMARK
to be able to mark the outgoing packets. Check out the new instructions in the iptables section. I can confirm it is working on my test setup.