2

This question is related to a previous one I asked.

I want to set up an OpenVPN dual client box such that a computer whose gateway is set to eth0:0 gets all their traffic routed through one OpenVPN tunnel, and a computer whose gateway is set to eth0:1 gets all their traffic routed through a different OpenVPN tunnel. Eventually, I want to be able to have multiple computers connecting to my dual client box, sharing that OpenVPN tunnel (but unaware of each other).

Diagram
(source: serahill.com)

I've set up the ethernet aliases in my dual client box and I've set my gateway on a connecting host to an ethernet alias on the dual client box. However, the routing doesn't appear to be happening properly. Any pings from my connecting host go directly to the default gateway of the dual client box instead of being routed through the tunnel.

These are the route commands I'm using once the tunnel is set up:

ip route add default dev $1 table us_table
ip rule add from [ip address of my ethernet alias] table us_table
ip route flush cache
iptables -t nat -A POSTROUTING -o $1 -j MASQUERADE[/code]

This is the routing table after the tunnel's set:

root@ahost:/etc/openvpn# ip route show
10.26.0.0/24 via 10.26.0.1 dev tun0 
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.242 
10.26.0.0/16 dev tun0  proto kernel  scope link  src 10.26.0.2 
default via 192.168.1.1 dev eth0  metric 100

This is the us_table routing table:

root@ahost:/etc/openvpn# ip route show table us_table
default dev tun0  scope link

My rules:

root@ahost:/etc/openvpn# ip rule show
0:  from all lookup local 
32765:  from 192.168.1.242 lookup us_table 
32766:  from all lookup main 
32767:  from all lookup default

Any suggestions on what I'm missing or doing wrong? I'm stumped here...

Improve this question
5
  • Could you please provide a simple network diagram for this, just to avoid confusion.
    – wolfgangsz
    Jun 13, 2011 at 11:12
  • Added a link to a simple network diagram
    – serpah
    Jun 14, 2011 at 5:00
  • Mhm, I believe I already advised you to drop the idea of interface aliases (as this won't work) and simply use the ip rule from <client> lookup <table> syntax?
    – the-wabbit
    Jun 14, 2011 at 13:12
  • Yep, you did. I wanted to know if there was a way to set the gateway on the connecting laptops without having to add routing rules to the Gateway server.
    – serpah
    Jun 15, 2011 at 2:14
  • There will be a lot of computers connecting and disconnecting from this Gateway server and I would like to have a way to set up the routing without having to add & delete rules for every client
    – serpah
    Jun 15, 2011 at 10:22

2 Answers 2

Reset to default
0

You have set the rule to match the ethernet alias address:

ip rule add from [ip address of my ethernet alias] table us_table

However, this will never match, as the masquerading is in the POSTROUTING chain, i.e. it happens after the routing decisions have already been made.

I have never used policy based routing, so I can only guess what you might have to do to get this working. The man page says that you can perform NAT before other rules, this might be able to sort you out. Alternatively you could use the actual IP address of the laptops or workstations as the source addresses (or ranges).

Improve this answer
0

Based on @syneticon-dj's suggestion, I assigned different subnets for the different OpenVPN clients and set up routing so that all IP addresses in a specific subnet get routed to a specific tun device.

This means that all connecting clients have to set their gateway to the OpenVPN Gateway and their IP address has to be in the correct subnet.

My commands once the OpenVPN tun is up are:

ip route add default dev tun0 table us_table
ip rule add from 192.168.233.0/24 table us_table
ip route flush cache
iptables -t nat -A POSTROUTING -o $1 -j MASQUERADE
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .