Server and Client on same machine

ideabox

Hello guys, I am running an OpenVPN server on a KVM-based virtual system for a number of clients and, for many complicated reasons, I would like to have this system connect to another (external) OpenVPN server, so that my client's traffic passes my virtual system and the external VPN on the way to the world wide web. As the external VPN server is also running OpenVPN, I figured my virtual system could simply act as a go-between, being an OpenVPN client of the external VPN provider and an OpenVPN server for my clients. But when I tried to set this up, the devices of the OpenVPN instances seemed to interfere with each other.

Essentially, the set-up I want is this: clients --> [my system] --> vpn service provider. I was hoping somebody more knowledgeable than me may be able to offer advice on how to go about setting this up.

server.conf for OpenVPN server on virtual system (where my clients connect to)

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
tls-server
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
ping-timer-rem
cipher BF-CBC
comp-lzo
user ovusr
group ovusr
persist-key
persist-tun
status openvpn-status.log
verb 3

connect.conf for OpenVPN client on virtual system (to connect to external VPN provider)

client
dev tun0
proto udp
remote <host> 1194
resolv-retry infinite
nobind
auth-user-pass
ca [inline]
tls-client
tls-auth [inline]
ns-cert-type server
keepalive 10 30
cipher AES-256-CBC
tls-cipher TLSv1:!ADH:!SSLv2:!NULL:!EXPORT:!DES:!LOW:!MEDIUM:@STRENGTH
persist-key
persist-tun
comp-lzo
tun-mtu 1500
mssfix
passtos
verb 3

<ca>
-----BEGIN CERTIFICATE-----
<cert here>
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
<keyhere>
-----END OpenVPN Static key V1-----
</tls-auth>

On the virtual system, when connecting to the VPN service provider as root, using "openvpn ~/connect.conf", the connection parameters seem to be set up fine at first, until eventually the connection fails with the following message:

Cannot open TUN/TAP dev /dev/tun0: No such file or directory (errno=2)

How would I have to modify the devices to be able to connect to the VPN provider, but at the same time keep the server running, so that my clients can still connect?

brendan

wild ass guessing here...

you have eth1 or such as your onboard NIC. you have a bridge br0 or such that you are using to attach your VMs to the local network segment via eth1. it seems to be me that the VM is able to see tun0 that is in use by the server, and needs tun1 to be created for use on the client side.

mwandelaar

@Ideabox:

I would suggest to change the line:

dev tun

on the server to

dev tun0

so you are sure the vpn-server on your KVM has the same interface for the clients. Which makes firewalling easier,

And then on the client-config (on the KVM-system, connection outside) change

dev tun0

dev tun

,or if you like to have a fixed interface-name

dev tun1

As far as i can see here, the first instance (openvpn server) picks /dev/tun0 and then connecting the client outside again want to claim /dev/tun0

You could push some additional routes on the vpn-server (your KVM) to the clients to be able to reach the second VPN-connection. And remember to enable ip-forwarding (and firewall-rules)

@brendan: Topicstarter is using TUN here, so ip-tunneling and therefore bridging (which is layer 2) is not needed here. Thanks anyway for the suggestion!

ideabox

Thank you for your valuable input, guys. I modified both configuration files on the KVM as suggested by mwandelaar. server.conf is now set to "dev tun0" while connect.conf is now set to "dev tun1". I then asked one of my clients to connect to my KVM, which seemed to be working fine as he was able to browse the web as usual. I then tried to connect the KVM to the external VPN provider, but this seemed to fail. Here is the log output:

Fri Mar 15 21:26:12 2013 /sbin/ifconfig tun1 VPNPROVIDERIP netmask 255.255.255.128 mtu 1500 broadcast VPNPROVIDERBROADCASTIP
Fri Mar 15 21:26:12 2013 /sbin/route add -net VPNPROVIDERNETIP netmask 255.255.255.255 gw VSERVERIP
Fri Mar 15 21:26:12 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw VPNPROVIDERGWIP
Fri Mar 15 21:26:12 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw VPNPROVIDERGWIP
Fri Mar 15 21:26:12 2013 /sbin/route add -net VPNPROVIDERNETIP netmask 255.255.255.255 gw VSERVERIP
SIOCADDRT: File exists
Fri Mar 15 21:26:12 2013 ERROR: Linux route add command failed: external program exited with error status: 7

Different from before, the connection does not fail outright. The client on the KVM remains active, but the clients connected to the KVM report not being able to connect to anything in the world wide web anymore. The result is the same if I set both server.conf and client.conf to the same device "dev tun".

Here are my current iptable rules in /etc/rc.local on the KVM:

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -o eth0 -i tun0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I believe there are two issues here:

1. The server and client instances on the KVM still seem to be fighting over tun devices.
2. As mwandelaar suggested, I probably have to add routes and iptable rules to make sure traffic reaches the external VPN provider's network. I am not sure how to go about this, especiallys since the connection still doesn't seem to get established properly.

Any suggestions?

mwandelaar

It seems to me you have an ip-conflict:

Fri Mar 15 21:26:12 2013 /sbin/route add -net VPNPROVIDERNETIP netmask 255.255.255.255 gw VSERVERIP
SIOCADDRT: File exists

Does your vpn-provider gives you an ip-address within the 10.8.0.0 range?
If yes, you can change the range in you server-config to something different, like:

server 10.20.30.0 255.255.255.0

Or anything else that suits you.

ideabox

Sorry for not getting back to you guys. Real life has kept me busy, so I haven't had a chance to try adjusting the IP range yet. Just wanted to thank you for your excellent help and let you know that I really appreciate your support. I'll post back here in case I run into any problems. Again, thanks a lot!

dazo

brendan wrotewild ass guessing here...

you have eth1 or such as your onboard NIC. you have a bridge br0 or such that you are using to attach your VMs to the local network segment via eth1. it seems to be me that the VM is able to see tun0 that is in use by the server, and needs tun1 to be created for use on the client side.

Just a very quick and brutal response.

This is wrong on many levels. First of all, bridging is almost never the solution (there are use cases where it is right to use, but very very seldom). Second, you cannot bridge tun devices (only tap). And VPN tunnels are not related to physical interfaces at all, unless you do bridging.

For more info on bridging vs routing ... please have a look here: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting