0

I have to external IPv4-IPs at my VPS. I want to route one to a VPN client, OpenVPN (tun). Only one VPN-Client should use the VPN, and I want to route all traffic to my second external IP to this VPN - to get a static address for some services like mail server at home. So I have done the following things:

  • VPS with two IPs (109.230.XXX.5; 109.230.XXX.6)
  • First IP is used for the VPN itself and other services like webserver and icecast2
  • Second IP should be routed to OpenVPN-Client
  • OpenVPN listens on 109.230.XXX.5 - has internal subnet 10.8.0.0/24 on tun0
  • OpenVPN client is behind NAT and has 10.8.0.6 from OpenVPN and 10.0.0.6 from my router (10.0.0.1) at home
  • external IP is 217.235.XXX.32 (dynamic)
  • iptables on the OpenVPN server are:

    iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT # Allow forwarding for VPN
    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE # Enable NAT for VPN
    iptables -t nat -A PREROUTING -d 109.230.XXX.6 -j DNAT --to-destination 10.8.0.6 # route 109.230.XXX.6 to my server.home'
    
  • If I try ping 109.230.XXX.6, tcpdump shows:

    $ tcpdump -ni tun0
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
    17:03:07.883564 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 13, length 64
    17:03:08.884923 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 14, length 64
    17:03:09.886750 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 15, length 64
    17:03:10.889176 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 16, length 64
    17:03:11.888974 IP 217.235.XXX.32 > 10.8.0.6: ICMP echo request, id 8969, seq 17, length 64
    
  • The reply is leaving over eth0 - the port connected to my home router. It looks like the following:

    $ tcpdump -ni eth0 | grep reply
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
    17:07:49.304936 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 1, length 64
    17:07:50.302311 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 2, length 64
    17:07:51.305998 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 3, length 64
    17:07:52.302204 IP 10.8.0.6 > 217.235.XXX.32: ICMP echo reply, id 8989, seq 4, length 64
    

Of course, my router at home drops the packet - it is not in the NAT table. So how to configurate server and client ( - my home server), to route the address to my homeserver? I get two IPs with my VPS, and want to use one for this purpose - to don't waste IPs with don't using them.

Much thanks in advance!

1

One way to handle this is to change the default route on the VPN client, such that it uses the VPN connection as its default gateway instead of using the router. If that's the only thing you do, it will break badly as the encapsulated packets themselves will get routed back into the VPN. So before you replace the default route, you create a route to just the VPN server address using your router as gateway.

Another improvement to consider is elimination of the NAT on the VPS when this particular public IP address is used. The VPN client could itself know what its public IP address is, and not be relying on NAT. The trick to get that working is that instead of assigning that IP address to the "physical" interface on the VPS it only shows up as the P-t-P address on the VPN interface. You would then have to enable proxy_arp on the "physical" interface.

  • Changing default route was what I tried. But the outgoing packet is leaving the server over the first IP, not the second which is used for VPN. For the second solution, can you give me an example for configuring (do I have to change something?) OpenVPN and assigning the address? Thanks! – wb7 Apr 7 '14 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.