I have 2 servers:
server A: Public IP --> 104.x.x.x
server B: Public IP --> 188.x.x.x

server A has 2 VPN servers:
Openvpn --> tun0
Wireguard --> wg0

        inet  netmask  destination
        inet6 fe80::ae7d:f7ab:615b:a78a  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 304 (304.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet  netmask  destination
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 22563  bytes 14268224 (14.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 20017  bytes 15166196 (15.1 MB)
        TX errors 0  dropped 6 overruns 0  carrier 0  collisions 0

I want that if any clients connect to openvpn or wireguard, instead of connecting to internet from server A, use server B internet connction

Clients (Openvpn or wireguard) --> Server A --> Server B --> Connect to internet

How can I make in possible? (using ssh or other way to forward traffic from server A to server B)

Thank you,
Best regards

  • 1
    The usual way to forward traffic is through routing. Are server A and server B on a common private network? – Piotr P. Karwasz Dec 25 '19 at 13:10
  • 2
    You need to use policy based routing (so you can select a routing table based on something other then destination - usually a source IP, or a QoS mark which can be set based on interface using iptables). – davidgo Dec 25 '19 at 19:35
  • Hello there,actually server A is in usa and Server B is in france and using public ip – Emad Sh Dec 27 '19 at 1:27

First you need to establish a VPN link between server A and B, let's say server B will get as address, server A and the virtual interface on server A will be called tun1. You can use whichever technology you fill more comfortable.

Then, as remarked by davidgo, you need to use policy based routing on server A. In order to do so:

  1. Add a new routing table to the file /etc/iproute2/rt_tables:

    200 vpn
  2. Add a selection rule to use the routing table vpn for all traffic coming from the private network:

    ip rule add from table vpn
  3. Fill the routing table

    ip route add dev tun0 src table vpn
    ip route add dev wg0 src table vpn
    ip route add dev tun1 src table vpn
    ip route add default via dev tun1 table vpn
  • you mean that I have to create tun1 interface with ip on server A that connected to server B and then set Iptables rules on server A? Thank's – Emad Sh Dec 29 '19 at 9:28
  • Yes, you must establish a VPN tunnel between server A and server B, e.g. OpenVPN you are already familiar with. The policy based routing table is for server A, while I assume server B will have a private IP You can obviously assign different IP's and have different virtual tun* interfaces. – Piotr P. Karwasz Dec 29 '19 at 10:18
  • I set on interface tun1 on server A and with ssh -w command, create establish connection from server B to server A (server A private IP but can't connect to internet can you help me more please? – Emad Sh Dec 29 '19 at 11:44
  • On server B you need a SNAT/MASQUERADING rule in the nat table of iptables (iptables -t nat -nvL POSTROUTING to list the rules). ssh is a bad choice as VPN tunnel since it uses TCP (all packets are sent in order, packets lost are resent, etc.). Start debugging by pinging server B's private address. – Piotr P. Karwasz Dec 29 '19 at 11:55
  • Actually I have to use ssh due some restriction I can ping private ip from both servers from server B and from server A – Emad Sh Dec 29 '19 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.