Here are my current environment details for clarification:
Platform: Linux VPS
OS: Ubuntu Server 20.04
Firewall: UFW
I have deployed an OpenVPN server on a Linux VPS. the VPN server works perfectly on both UDP and TCP protocols. the server has had a single IPv4 address which I call it IP1
for reference here. whenever I connect to my VPN on my client machines. my client IP address becomes the IP1
which is totally perfect.
BUT, now I have assigned a second IPv4 to my VPS which I call it IP2
for reference here.
the network interfaces of my server are like this now:
- eth0 → IP1
- eth0:1 → IP2
I’ve setup three instances of OpenVPN on my VPS with these configs:
- 10.8.0.0 → IP1 -> 1194 (UDP)
- 10.8.1.0 → IP1 -> 443 (TCP)
- 10.8.2.0 → IP2 -> 1195 (UDP)
I’ve also added these rules into /etc/ufw/before.rules
file:
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/8 -o eth0 -j SNAT --to-source IP2
and everything works fine and I can connect to VPN on all three ports, But the issue is that when I connect on port 1195
which is configured to route to IP2
, my client still gets the IP1
from the server and when I check my IP it shows me IP1
.
I want to know what should I do to be able to configure the server to access the public internet using the IP2
when a client connects to VPN on port 1195
?
Thanks in advance.
UPDATE -
the full output of iptables-save -t nat
:
# Generated by iptables-save v1.8.4 on Tue Jun 28 14:26:28 2022
*nat
:PREROUTING ACCEPT [1:40]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
COMMIT
# Completed on Tue Jun 28 14:26:28 2022