0

Here are my current environment details for clarification:

Platform: Linux VPS
OS: Ubuntu Server 20.04
Firewall: UFW

I have deployed an OpenVPN server on a Linux VPS. the VPN server works perfectly on both UDP and TCP protocols. the server has had a single IPv4 address which I call it IP1 for reference here. whenever I connect to my VPN on my client machines. my client IP address becomes the IP1 which is totally perfect.

BUT, now I have assigned a second IPv4 to my VPS which I call it IP2 for reference here.

the network interfaces of my server are like this now:

  1. eth0 → IP1
  2. eth0:1 → IP2

I’ve setup three instances of OpenVPN on my VPS with these configs:

  1. 10.8.0.0 → IP1 -> 1194 (UDP)
  2. 10.8.1.0 → IP1 -> 443 (TCP)
  3. 10.8.2.0 → IP2 -> 1195 (UDP)

I’ve also added these rules into /etc/ufw/before.rules file:

-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j SNAT --to-source IP1

-A POSTROUTING -s 10.8.1.0/8 -o eth0 -j SNAT --to-source IP1

-A POSTROUTING -s 10.8.2.0/8 -o eth0 -j SNAT --to-source IP2

and everything works fine and I can connect to VPN on all three ports, But the issue is that when I connect on port 1195 which is configured to route to IP2, my client still gets the IP1 from the server and when I check my IP it shows me IP1.

I want to know what should I do to be able to configure the server to access the public internet using the IP2 when a client connects to VPN on port 1195?

Thanks in advance.

UPDATE - the full output of iptables-save -t nat:

# Generated by iptables-save v1.8.4 on Tue Jun 28 14:26:28 2022
*nat
:PREROUTING ACCEPT [1:40]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0:1 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j SNAT --to-source IP2
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.1.0/24 -o eth0 -j SNAT --to-source IP1
-A POSTROUTING -s 10.8.2.0/24 -o eth0 -j SNAT --to-source IP2
COMMIT
# Completed on Tue Jun 28 14:26:28 2022

1 Answer 1

1

You should use /24 instead of /8 in the -s matches of your SNAT rules.

FINAL TOUCH:

after changing the rules try iptables -t nat -F POSTROUTING and restart the ufw, and check with iptables-save -t nat after that to make sure there are no other conflicting SNAT / MASQUERADE rules.

6
  • I did it, but still the same, I get IP1 when I connect to VPN on port 1195. any further idea? should I define new iptables for it to work? as mentioned here: Linux Advanced Routing And Traffic Control HOWTO Jun 28, 2022 at 10:24
  • Add the FULL output of iptables-save -t nat to your question. (IP1 and IP2 can remain redacted if you wish.)
    – Tom Yan
    Jun 28, 2022 at 12:04
  • I've added the result, please take a look. Jun 28, 2022 at 14:36
  • Try iptables -t nat -F POSTROUTING before you / and restart the ufw, and check again with iptables-save -t nat after that to make sure there are no other conflicting SNAT / MASQUERADE rules.
    – Tom Yan
    Jun 28, 2022 at 14:52
  • Wow, thank you dear Tom, you saved my life indeed. I was struggling for a week. it worked after executing iptables -t nat -F POSTROUTING and all intervening rules got removed. Jun 28, 2022 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .