3

Yes, I know. Ugh!

I have a small office and we're trying to reduce our network expense.

Because of client audit requirements, we run our own mail server, and would like to keep it that way. For that we need two static IPs. So far, we've had a 'StaticIP business plan' with our ISP for our office network. The service has been less than great.

I want to switch the office connection to the cheapest/fastest dynamic plan I can find; lots of options. But this means giving up our static IPs for the mailserver.

We also have a small VPS in the cloud for a simple website. It doesn't have enough resource to host our mailserver, but is DOES have 2 static IPs.

I'd like to set up a 'tunnel' that uses the VPS's static IPs as our publicly-visible IP address for our mailserver, and connects to the actual mailserver -- now on our LAN with NAT behind a dynamic IPv4.

After a LOT of reading, the way I'm thinking of doing this is by using OpenVPN to connect the office's mailserver using a local OpenVPN client to an OpenVPN server running on the VPS -- all over 'static' IPv6 which is provided by a tunnel broker (HE.net), and is independent of our ISP.

I managed to get the IPv6 tunnel setup. And the OpenVPN server & client. I can even make a connection between the two over the IPv6

At this point, I'm stuck -- I'm completely lost in the routing (I think!) needed to get the external IPv4 addresses on the VPS to talk- and listen-to the internal IPv4 addresses the mailserver is listening on over the IPv6 link.

I've found a bunch of articles online, but they all seem to say "just setup a OpenVPN connection between the client and server", not giving much detail at all -- that I can understand, anyway :-( -- and then say nothing about getting the mapping of addresses and inbound & outbound traffic all done.

There's also a firewall in place on both the VPS and the Office router. I haven't even begun to think about what I need to open for the IMAP & SMTP traffic over the VPN ...

Can someone share a doc, or help with a good walk-through of what to do here, and how?

For reference, my network layout is:

------------------------------------
| VPS Server                       |
|    eth0:                         |
|       IPv4 = 172.16.10.100       |
|       IPv6 = 2100:...:0444::100  |
|    tun1:                         |
|       IPv6 = 2199:...:1          |
------------------------------------
      |              |
      |              |
      |       ---------------------------------
      |       |    eth1:                      |
      |       |       IPv4 = 172.16.10.63     |
      |       |       IPv6 = 2100:...:0444:2  |
      |       |                               |
      |       | Server-side Gateway           |
      |       |                               |
      |       |    eth0: (PUBLIC IPs)         |
      |       |       IPv4 = x.y.z.63         |
      |       |       IPv6 = 2100:...:0444:1  |
      |       ---------------------------------
      |              |
      |              |
      |       ----------------
     VPN      | Internet/WAN |
      |       ----------------
      |              |
      |              |
      |       ---------------------------------
      |       |    eth0:                      |
      |       |       IPv4 = a.b.c.24         |
      |       |       IPv6 = 2600:...:0123:1  |
      |       |                               |
      |       | Client-side Gateway           |
      |       |                               |
      |       |    eth1:                      |
      |       |       IPv4 = 192.168.1.24     |
      |       |       IPv6 = 2600:...:0123:2  |
      |       ---------------------------------
      |              |                             ------------------------------------
      |              |-----------------------------|  MailServer                      |
      |              |                             |     eth0:                        |
      |              |                             |        IPv4 = 192.168.1.199      |
      |              |                             |        IPv6 = 2600:...:0123:199  |
      |              |                             ------------------------------------
------------------------------------
| Client                           |
|    eth0:                         |
|       IPv4 = 192.168.1.100       |
|       IPv6 = 2600:...:0123:100   |
|    tun1:                         |
|       IPv6 = 2699:...:1          |
------------------------------------

and the specific goal is to have message traffic FROM the Internet/WAN targeted at my "PUBLIC IPs" on the VPS

IPv4 = x.y.z.63         port 25
IPv6 = 2100:...:0444:1  port 25

be redirected immediately TO the listening "MailServer", and,

traffic FROM the MailServer be properly routed OUT the "PUBLIC IPs", appearing to originate from those external IPs.

I've been able to get parts of the idea working working following the examples I've found online and in an OpenVPN cookbook, but once I've added the IPv6 tunnel, I've had no luck yet getting the client routes, push routes, etc all set up so traffic flows.

1
  • 2
    Wow, this sounds so messy that I fear it will be even less reliable than your current setup. Aug 5, 2013 at 19:04

2 Answers 2

1

You should be able to eschew the VPN and go direct via IPv6 from the VPS to the Mail server if you were to run a TCP proxy on the VPS Server.

Socat would do the trick on Linux:

socat -d -d -lmlocal2 \
TCP4-LISTEN:25,bind=myaddr1,su=nobody,fork,reuseaddr \
TCP6:mail.domain.local:80,bind=myaddr2

Or netsh on windows:

netsh interface portproxy add v4tov6 listenport=25 connectaddress=mail.domain.local connectport=25 protocol=tcp

Either would forward connections made to the IPv4 address of the VPS server to the IPv6 address of the mail server.

This would also have the added benefit of skipping the VPS if the sender has IPv6 access.


If you are hell-bent on using OpenVPN with no port forwarding, you would have to do something like the following to get traffic across:

  • Set up IPv6 access to edge hosts
  • Set up v4 p2p tunnel across IPv6 internet
  • Set up routing to allow all traffic from mailserver to flow across tunnel
  • Set up NAT to translate the secondary v4 address to the private v4 address of the mailserver

Assuming IPv4 public addresses of 1.2.3.2 and 1.2.3.3 with a gateway of 1.2.3.1. Assuming IPv6 public addresses of [2001:abcd:1::] for the VPS site Assuming IPv6 public addresses of [2001:abcd:2::] for the client site Assuming IPv4 tunnel addresses of 10.1.100.1 for the VPS edge and 10.1.100.2 for the Client edge

Note: this is somewhat pseudocode, but would be pretty close to a cisco config. I don't have the equivalent iptables and OpenVPN configurations on hand, but they should be easily translated.

VPS Gateway:

! gateway acts as a router
ip routing
ipv6 unicast-routing

! interfaces
interface outside
  ip address 1.2.3.2 255.255.255.248
interface inside
  ip address 172.16.10.63 255.255.255.0
  ipv6 address 2001:abcd:1:1::1 /64
interface tunnel6
  ipv6 address 2001:abcd:1::1
  tunnel source 1.2.3.2

! Routing table:
! send traffic for the client net via the openvpn p2p link
ip route 192.168.1.0 255.255.255.0 172.16.10.100
ip route 0.0.0.0 0.0.0.0 1.2.3.1
ipv6 route ::0/0 2001:abcd:1::2

! NAT Table:
! nat the mailserver
static (outside,inside) 1.2.3.4 192.168.1.199 netmask 255.255.255.255

VPS Server:

! vps server acts as a v4 router
ip routing

! interfaces
interface inside
  ip address 172.16.10.100
  ipv6 address 2001:abcd:1:1::100 /64

interface tun0
  tunnel source 2001:abcd:1:1::100
  tunnel destination 2001:abcd:2:1::100
  ip address 10.1.100.1 255.255.255.252

! Routing table:
ip route 192.168.1.0 255.255.255.0 10.1.100.2
ip route 0.0.0.0 0.0.0.0 172.16.10.63
ipv6 route ::0/0 2001:abcd:1:1::1

Client router:

! gateway acts as a router
ip routing
ipv6 unicast-routing

! interfaces
interface outside
  ip address from dhcp
interface inside
  ip address 192.168.1.24 255.255.255.0
  ipv6 address 2001:abcd:2:1::1 /64
interface tunnel6
  ipv6 address 2001:abcd:2::1

! routing
ip route 172.16.10.0 255.255.255.0 192.168.1.100
ipv6 route ::0/0 2001:abcd:2::2

Client edge:

! client edge acts as a v4 router
ip routing

interface inside
  ip address 192.168.1.100 255.255.255.0
  ipv6 address 2001:abcd:2:1::100 /64
interface tunnel0
  tunnel source 2001:abcd:2:1::100 
  tunnel destination 2001:abcd:1:1::100
  ip address 10.1.100.2 255.255.255.252

ip route 172.16.10.0 255.255.255.0 10.1.100.1

! use pbr to send internet traffic from the mailserver over the vpn
access-list 1 permit 192.168.1.199
route-map pbr-mailserver-vpn permit 10
  match ip address 1
  set ip default next-hop 10.1.100.1
route-map pbr-mailserver-vpn permit 20
  set ip default next-hop 192.168.1.24

Mail server:

interface inside
  ip address 192.168.1.199 255.255.255.0

! since our default traffic must be natted to the secondary VPS IP, forward over 
! client edge to vpn
ip route 0.0.0.0 0.0.0.0 192.168.1.100

Note: if your edge routers support GRE or another encapsulating tunnel protocol, you could skip the servers and do the tunneling on the routers. Keep in mind, however, that the client router must be able to do policy routing based on source address to return traffic from the mailserver back over the tunnel.

I will emphasize again that this provides little benefit over doing port forwarding from v4 to v6, and increases the complexity to a ridiculous point. It also will introduce hard to trace issues like asymmetric routes, NAT, and multiple layers of tunnels (which will lower the MTU by about 400 bytes).

10
  • Thanks, but I'm interested in forwarding via OpenVPN, as in my original question.
    – ArielG
    Aug 7, 2013 at 15:24
  • @ArielG, any reason? The VPN is entirely unnecessary to do what you are attempting... In fact, OpenVPN does not even support port forwarding.
    – Mitch
    Aug 7, 2013 at 17:25
  • Because it's step one for me in additionally opening up the lans behind the server & client gateways to one another. OpenVPN will be required. I don't want to end up building an maintaining multiple tunnels/pipes/etc. One secured pipe -- via OpenVPN over IPv6 -- is the goal. The 1st reality is that I need to get the traffic from those 'external' static IPs to/from the mail server on the other LAN.
    – ArielG
    Aug 7, 2013 at 21:05
  • Thx for all that up there. NOw to try it out!
    – ArielG
    Aug 7, 2013 at 21:12
  • @ArielG, Ok, but keep in mind there is no benefit of encrypting traffic which travels over the internet. Even provided the requirements, I would still recommend port forwards.
    – Mitch
    Aug 7, 2013 at 21:46
0

Why don't you let the office server do inbound mail (SMTP) on IPv6-only, and use the VPS as a fallback with dual-stack? Senders that support IPv6 can send straight to the office server, and others can send to the VPS, which will then relay it over IPv6 to the office.

1
  • That's not at all what I'm looking to do, or what my question's about. There will be one mail server -- on my office lan. I really would like to learn how to do what it is I'm asking about.
    – ArielG
    Aug 5, 2013 at 22:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .