Hello!
I have 2 offices.
Each office has it's internet gateway.
Gateway in office 1:
OS - Ubuntu 11.04.
Public ip network card eth1 - xxx.xxx.xxx.xxx
Local network card - eth0 - 192.168.0.140
Internet is shared with setting system variable:
/proc/sys/net/ipv4/ip_forward = 1
and iptables rule
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Gateway in office 2:
OS - Ubuntu 11.04.
Public ip network card eth1 - yyy.yyy.yyy.yyy
Local network card - eth0 - 192.168.1.223
Internet is shared with setting system variable:
/proc/sys/net/ipv4/ip_forward = 1
and iptables rule
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
The goals of using openvpn (2.1) are:
1 - to connect offices in one local network.
2 - to route all outgoing traffic exclude traffic to office 1 from office 2 through vpn that i get from third party service.
First goal is achived in such way:
I set up the gateway of office 2 as a openvpn server. Here is the config:
dev tun
tls-server
port 1194
proto udp
ifconfig 192.168.254.1 192.168.254.2
route 192.168.0.0 255.255.255.0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 4
Then i set up the gateway of office 1 as a openvpn client, here the config file:
remote yyy.yyy.yyy.yyy
port 1194
tls-client
dev tun
proto udp
persist-key
persist-tun
ifconfig 192.168.254.2 192.168.254.1
route 192.168.1.0 255.255.255.0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key
comp-lzo
verb 4
mute 20
log-append openvpn.log
Then i add rules to iptables of gateway 1 (there openvpn client):
sudo iptables -A INPUT -i tun+ -j ACCEPT
sudo iptables -A OUTPUT -o tun+ -j ACCEPT
sudo iptables -A FORWARD -i tun0 -j ACCEPT
sudo iptables -A FORWARD -o tun0 -j ACCEPT
and add iptables rules to gateway 2 (there openvpn server):
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT
sudo iptables -A INPUT -i tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -j ACCEPT
sudo iptables -A FORWARD -o tun0 -j ACCEPT
Networks are connected and PC's from one "see" PC's from other (ping, smb, print etc.)
Second goal is achived in such way:
I know, vpn server of my third party service include redirect gateway instruction.
I get client config file from third party service. Put it to /etc/openvpn directory of gateway 2. Here is it:
nobind
client
remote us4.prostovpn.ru
ca /etc/openvpn/usefree/ca.crt
cert /etc/openvpn/usefree/usefree.crt
key /etc/openvpn/usefree/usefree.key
fast-io
remote-cert-tls server
dev tun
proto udp
resolv-retry infinite
persist-key
persist-tun
explicit-exit-notify
And then i changed iptables rule:
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
changed to:
sudo iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
in order to route all traffic of network 2 to vpn tunnel. And all traffic from network 2 is routed to vpn tunnel. But i lost connection with my office 1. And public ip of gateway 2 become unavailable.
And now the question.
What routing should i make on gateway 2, in order to achieve my goals?
