0

I'm trying to configure a double vpn. I decided to use a server and a client instead of two servers.

So it has to work like this:

  • Client1 and Server are VPS, Client2 is my PC;
  • Server redirect all traffic from Client2(my PC) to internet through itself and Client1(VPS)
  • Way should be -- Client2(my PC) -> Server(VPS) -> Client1(VPS) -> Internet

But something is wrong and I am stuck, really don't know what to do.

Here are my .conf files

server.conf

port 1194
proto udp
dev tun0
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh2048.pem
tls-auth /etc/openvpn/server/ta.key 0
remote-cert-tls client
auth SHA512
cipher AES-256-CBC
topology subnet
server 10.10.1.0 255.255.255.0
route 10.10.1.2 255.255.255.255 10.10.1.2
route 10.10.1.3 255.255.255.255 10.10.1.3
client-config-dir ccd
push "route 10.10.1.0 255.255.255.0"
keepalive 10 120
persist-key
persist-tun
user nobody
group nogroup
verb 3
log openvpn.log
status openvpn-status.log
ifconfig-pool-persist ipp.txt
sndbuf 0
rcvbuf 0
comp-lzo
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
explicit-exit-notify 1

ccd client1

ifconfig-push 10.10.1.2 255.255.255.0
iroute 10.10.1.3 255.255.255.255 10.10.1.1
push "route 10.10.1.3 255.255.255.255 10.10.1.1"

ccd client2

ifconfig-push 10.10.1.3 255.255.255.0
iroute 10.10.1.2 255.255.255.255 10.10.1.1
push "route 10.10.1.2 255.255.255.255 10.10.1.1"
push "redirect-gateway def1 bypass-dhcp"
push "route-gateway 10.10.1.2"

Client1 & Client2 .conf are the same

client
dev tun0
proto udp
remote (server-ip) 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client1.crt
key /etc/openvpn/client/client1.key
tls-auth /etc/openvpn/client/ta.key 1
auth SHA512
cipher AES-256-CBC
comp-lzo
log client.log
verb 3
sndbuf 0
rcvbuf 0

ip forward is enable on Server(VPS) and Client1(VPS)

1194 port is enable on Server(VPS)


Server(VPS) iptables rules witch I added:

  • iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  • iptables -A FORWARD -s 10.10.1.3 -d 10.10.1.2 -m conntrack --ctstate NEW -j ACCEPT

Client1(VPS) iptables rules witch I added:

  • iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  • iptables -I FORWARD -i tun0 -o eth0 -s 10.10.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
  • iptables -t nat -I POSTROUTING -o eth0 -s 10.10.1.0/24 -j MASQUERADE

Server(VPS) route table

Client1(VPS) route table

Client2(my PC) route table


traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  10.10.1.1 (10.10.1.1)  144.958 ms  144.932 ms  144.922 ms
 2  * * *
 3  * * *
     ...
 30 * * *

P.S. I'm new to linux, trying to self learn it

  • Use ip route show to show the routing tables, and paste the output as text in your answer, don't link to images. When should the server send traffic directly to the internet, and when should that be routed through client1? – wurtel Mar 7 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.