So, here is the picture:
The server configuration is a pretty standard configuration:
Code: Select all
port 1194
auth-user-pass-verify /etc/openvpn/script/login.py via-env
username-as-common-name
script-security 3
proto udp
dev tun
duplicate-cn
sndbuf 0
rcvbuf 0
vca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0 (or 10.8.100.0 in the VPN2)
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
Code: Select all
client
dev tun
auth-user-pass login.txt
proto udp
sndbuf 0
rcvbuf 0
remote 45.55.45.55 1194 (or 186.186.186.186 for VPN2)
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-128-CBC
comp-lzo
key-direction 1
verb 3
Code: Select all
openvpn --config toOpenVPN1.ovpn
Code: Select all
openvpn --config toOpenVPN2.ovpn --route-nopull
As the client doesn't have to care if its traffic is being redirected to another location, I'm assuming that there is no configuration or iptables rules needed to be done in its side (client). The same follows to the VPN2 server, that doesn't need to know if it is coming from VPN1 or other peers. So, all I have to setup is VPN1 configurations.
First of all, I will set iptables rules, as follows. This will just allow the traffic to go by.
Code: Select all
iptables -A INPUT -i tun1 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun1 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o tun1 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp -m multiport --dports 6880:7000 -j DROP
iptables -A FORWARD -i tun1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -d 10.8.100.0/24 -i tun0 -o tun1 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -s 10.8.100.0/24 -d 10.8.0.0/24 -i tun1 -o tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
Code: Select all
route add 0.0.0.0/0 dev tun0
route add 0.0.0.0/0 dev tun1
### route from the the first tunnel, through the client's IP
route add -net 10.8.0.0/24 gw 10.8.0.2 dev tun0
### same for the 2nd
route add -net 10.8.100.0/24 gw 10.8.100.1 dev tun1
### route all the traffic to the 2nd VPN
### end server's IP and internet's gateway
route add 186.186.186.186 gw 45.55.45.1
route add default gw 10.8.100.1 dev tun1 <<<<<<<<<<<<<<<<<< got locked out of VPN1 server
How would be a correct set of routes for VPN1? Could anyone help me?