I have a Linux OpenVPN server with two clients, A and B. I've set these up with client-to-client so they can talk to each other. I want to make client A to be the default route for client B so that B can access the internet via the route: B->server->A->NAT->internet. The internet happens to be A's default route, and both A and B tunnels are over the internet using their own native default routes.

At the moment with a TUN and no special routing directives I can ping from A to server, B to server and A to B, but there's no route beyond B.

The difficulty is... A already has some complex routing tables (plural) driven by a pile of iptables rules. I don't want OpenVPN to touch these because it'll break routing elsewhere. The server has a completely different default route. So I need to tell:

  1. B's default route to be the server
  2. OpenVPN on the server to route globally-addressed packets it received from B on to A
  3. A to NAT the packets and send them out of the global interface
  4. The same to happen in reverse

I think I've set up iptables to do 3. I could do some iptables rules to do B to A forwarding using a fresh routing table... but they're all inside one TUN interface so iptables won't see them. If I use iroute it'll interfere with the routing on the server.

One option is a TAP device - bridge across the server and then, instead of NAT, bridge the server to B TAP into the WAN interface. I've got this as far as A-server-B (flip everything to dev tap, no other changes), but then I lose contact with B when I bridge tapB and WAN (after turning off NAT). Also this causes positive feedback: the noise from the other traffic on A's WAN interface (ARP requests etc) is tunnelled into the TAP, which causes extra traffic on the WAN interface, and so on.

Another option is two TUN devices and iptables between them... this is my last resort.

So... how to I tell OpenVPN to do packet forwarding within its own interfaces, without disturbing the OS-side routing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.