I have a Linux server A with a block of 5 public IP addresses, Currently, is assigned to eth0, and is assigned to eth0:1.

I have another Linux machine B in a remote location, behind NAT. I would like to set up an tunnel between the two so that B can use the IP address as its primary IP address.

OpenVPN is probably the answer, but I can't quite figure out how to set things up (topology subnet or topology p2p might be appropriate. Or should I be using Ethernet bridging?). Security and encryption is not a big concern at this point, so GRE would be fine too -- machine B will be coming from a known IP address and can be authenticated based on that.

How can I do this? Can anyone suggest an OpenVPN config, or some other approach, that could work in this situation? Ideally, it would also be able to handle multiple clients (e.g. share all four of spare IPs with other machines), without letting those clients use IPs to which they are not entitled.

  • What firewalls are at both locations? – Robert Sep 24 '12 at 21:13
  • 1
    I hope you just made up those addresses, rather than that you actually work at Google. If you don't, you aren't going to be able to use their address space. – Michael Hampton Sep 24 '12 at 21:23
  • Robert: A is a Linux server with some simple iptables rules. B is behind a NAT that is another Linux server running shorewall. – Jim Paris Sep 24 '12 at 21:25
  • Michael: Yes, I changed the first three octets to 8 to obfuscate them, but still indicate that they're public. Sorry, Google. – Jim Paris Sep 24 '12 at 21:26
  • 1
    For future reference, we have an RFC for that. – Michael Hampton Oct 11 '12 at 13:29

I ended up going with the Ethernet bridging. Lots of extremely verbose examples to wade through online, but it turns out to be pretty easy:

First, on A, /etc/network/interfaces was changed from:

auto eth0
iface eth0 inet static


auto br0
iface br0 inet static
    pre-up openvpn --mktun --dev tap0
    bridge_ports eth0 tap0
    bridge_fd 3

in order to bridge eth0 (the real WAN interface) with tap0 (a new tunnel interface) at boot.

Then, on A, run the openvpn server with:

openvpn --dev tap0

On B, connect to it with:

openvpn --remote --dev tap0 --route-gateway \
        --redirect-gateway def1 --ifconfig

That's the super simple config I was looking for, and it works -- B is now publicly accessible at, and outgoing connections originate from the same address.

Add security (--secret, --tls-server, etc) as needed, of course.

  • Nice! I'm going to try that. Did you find a way to configure that: "without letting those clients use IPs to which they are not entitled"? – Bastian Dec 10 '15 at 0:28
  • I didn't bother in my setup (which was temporary), but I imagine you could do it with ebtables. – Jim Paris Dec 14 '15 at 21:53
  • Very useful. A question: what I need to change in A configuration if I need to route two IP from A: A => B and A => C (where C is another host)? Do I need to configure another bridge ? – frhack Jan 13 '16 at 8:01
  • 2
    Yeah. Add another pre-up openvpn line to create tap1 too, add tap1 to bridge_ports, and run another instance of openvpn with openvpn --dev tap1. – Jim Paris Jan 14 '16 at 15:08
  • How about if you wanted to make A's gateway local via B so any system on the LAN can use B and assign the remote default gateway and use public IPs? – Areeb Soo Yasir Aug 8 '17 at 22:27

You're going to have a hard time I think. Most firewalls will have difficulty routing OpenVPN traffic if both sides of the VPN are in the same subnet.

If you are trying to route for public access, I'd move both servers to different subnets from your public addresses and then use Virtual IPs (1 to 1 Nat) to connect them. To connect the two sites, OpenVPN would work or an IP-Sec tunnel.

Virtual IPs: http://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses%3F

Site to site: http://doc.pfsense.org/index.php/VPN_Capability_IPsec

Edit based on comments:

I'd personally install pfSense on the A box and give it the port you wanted for its WAN. Then setup an OpenVPN server on a local subnet (which is all ready to go in the pfSense web interface) and setup the other machine with a Virtual IP pointed to its local OpenVPN ip. This would give you room for expansion later (add more machines with Virtual IPs, logically forward specific ports to different servers, really have a full blown LAN/WAN/DMZ setup with OpenVPN for virtual access. Not to mention that you'd have a full blown router so it'd likely be more secure.

  • I don't understand how intermediate firewalls are involved; they certainly won't be looking inside the OpenVPN packets between A and B. For the OpenVPN config itself, I was expecting that something like push "route net_gateway" would ensure that the VPN data is still pushed over the normal network. – Jim Paris Sep 24 '12 at 21:29
  • To be clear, I want to create tunnel directly between A and B, not on separate firewalls at each end. – Jim Paris Sep 24 '12 at 21:32
  • 1
    But when computer A wants to route to computer B it won't know if it should use the WAN (with your public IPs), the LAN (with its static IP) or the OpenVPN (also with your public IPs) because they are all same subnet. B to A should work though. – Robert Sep 24 '12 at 21:33
  • 1
    Also there is this, I've had it working but not with public IPs. I think virtual ip's will be much better either way. openvpn.net/index.php/open-source/documentation/miscellaneous/… – Robert Sep 24 '12 at 21:39
  • "To be clear, I want to create tunnel directly between A and B, not on separate firewalls at each end." You are going to need to open a port somewhere for an OpenVPN server – Robert Sep 24 '12 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.