1

I am using a device running on openwrt (chaos_calmer 15.05)

I am trying to forward network traffic from two differents SSID to two different vps running openvpn

My setup is working with only one wifi / tun interface. It seems impossible to work that with the two VPN (openvpn client) at the same time.

I don't understand why :/ I think it's not a very complicate setup I hope somebody could help me here since you're network experts.

I think it's a routing issue but I am not sure. Anyone can help me to fix this please ?

To simplify this, my setup looks like :

eth0 (internet link) <===== tun0 <==== wifi-A
eth0 (internet link) <===== tun1 <==== wifi-B

Note the following statements

  1. My openwrt device get the Internet link with the eth0 interface using DHCP

  2. I created a bridge on my wlan0 interface to be able to broadcast two SSID : (wifi-a & wifi-b)

  3. On wifi-a : a DHCP server is running pool 172.17.42.100-200 gw 172.18.42.1

  4. On wifi-b : a DHCP server is running pool 172.18.42.100-200 gw 172.18.42.1

  5. I have two VPS where I installed openvpn : PublicIP-1 & PublicIP-2

  6. I run on my device two openvpn client to public-IP-1 (tun0) and to public-IP-2 (tun1)

  7. Finally I nated wifi-a subnet to tun0 and wifi-b subnet to tun1 with the following iptables rules :

    iptables -t nat -A POSTROUTING -s 172.17.42.0/24 -o tun0 -j MASQUERADE iptables -A FORWARD -s 172.17.42.0/24 -o tun0 -j ACCEPT iptables -A FORWARD -d 172.17.42.0/24 -m state --state ESTABLISHED,RELATED -i tun0 -j ACCEPT

    iptables -t nat -A POSTROUTING -s 172.18.42.0/24 -o tun1 -j MASQUERADE
    iptables -A FORWARD -s 172.18.42.0/24 -o tun1 -j ACCEPT iptables -A
    FORWARD -d 172.18.42.0/24 -m state --state ESTABLISHED,RELATED -i tun1 -j ACCEPT
    

Below my interface details :

eth0 inet addr:192.168.0.10 Bcast:192.168.0.255 Mask:255.255.255.0

br-wifi-a inet addr:172.17.42.1 Bcast:172.17.42.255 Mask:255.255.255.0

br-wifi-b inet addr:172.18.42.1 Bcast:172.18.42.255 Mask:255.255.255.0

tun0 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255

tun1 inet addr:10.9.0.6 P-t-P:10.9.0.5 Mask:255.255.255.255

My route table :

Destination Gateway Genmask Flags Metric Ref
Use Iface

default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0

10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0 10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0 10.9.0.1 10.9.0.5 255.255.255.255 UGH 0 0 0 tun1 10.9.0.5 * 255.255.255.255 UH 0 0 0 tun1

PublicIP-1 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0

PublicIP-2 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0

172.17.42.0 * 255.255.255.0 U 0 0 0 br-wred

172.22.42.0 * 255.255.255.0 U 0 0 0 br-lan 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0

Quick debug :

ping google.com -I tun1 PING google.fr (108.177.119.94): 56 data bytes 64 bytes from 108.177.119.94: seq=0 ttl=43 time=29.665 ms

ping google.com -I tun0 PING google.fr (108.177.119.94): 56 data bytes 64 bytes from 108.177.119.94: seq=0 ttl=43 time=30.277 ms

ping google.com -I eth0 PING google.fr (108.177.119.94): 56 data bytes 64 bytes from 108.177.119.94: seq=0 ttl=42 time=17.860 ms ^C

Do you know where I am failing? Thanks for your help guys,


Additionally, I tried the following to add the add default gw for my tun interfaces :

echo "1 vpna" >> /etc/iproute2/rt_tables
echo "2 vpnb" >> /etc/iproute2/rt_tables

ip rule add from 10.8.0.0/24 dev tun0 table vpna
ip rule add from 10.9.0.0/24 dev tun1 table vpnb

ip route add default via 10.8.0.5 dev tun0 table vpna
ip route add default via 10.9.0.5 dev tun1 table vpnb

0

You must log in to answer this question.

Browse other questions tagged .