openvpn server behind xinetd howto get real ip address?

m.ardito

hi all, first post! :-)

i have a working linux openvpn 2.1 (rc19) server which has private address, inside a lan firewall.
openvpn server conf is quite standard TUN.

i have no more free external ip address to map to the openvpn server so, to let external users reach the openvpn i've set up a xinetd redirection service on a linux reverse proxy machine (which is of course already reachable from the internet): it listens port xxxx and redirects that to the openvpn server on standard openvpn port

btw, on rev proxy

i added this on /etc/services (replaced real port with xxxx)
-------------------------------------
ovpn xxxx/tcp #Openvpn
ovpn xxxx/udp #Openvpn
-------------------------------------

and this as /etc/xinetd.d/openvpn (replaced real ip with xxx'ed one)
-------------------------------------
service ovpn
{
flags = REUSE
socket_type = stream
wait = no
user = root
redirect = 192.168.xxx.xxx 1194
log_on_failure += USERID
}
-------------------------------------

it works well, and i am able to connect using multiple clients at the same time BUT

in logs and on management interface (enabled in server.conf) i see the connection coming from the xinetd server, of course...

so i'm asking you experts...

1) is there any way to make xinetd forward real ipaddress to openvpn?
2) is there any better method to implement this kind of config?
3) is there any better configuration of this setup, apart from the "real ip address" issue? any advice?

Thank you, Marco

maikcat

stupid question...

why dont you change the port used by openvpn server to something else..

i dont see a reason why on earth you need xinetd to call openvpn... :shock:

xinetd works well with services like telnet,vnc,finger etc..

Michael.

m.ardito

hi, and thanks for your fast reply!

yes, it could be i am doing stupid things, just because i'm learning everyday... :-)

in fact, openvpn runs on another port, not the standard one but i don't see how that helps here?

i dont see a reason why on earth you need xinetd to call openvpn

i thought of this solution because the openpvn machine is not reachable from the internet! and i knew that xinetd could "forward" to another machine... it seemed quite easy and effective as a solution...

only the (in the middle) machine running revproxy, needed for web servers (an now also xinetd to forward openvpn traffic) is reachable!

maybe it is not clear, i have this setup:

internet--->firewall--->revproxy+xinetd--->openvpnmachine

i would like to do this
internet--->firewall--->openvpnmachine

but i can't do this because i cannot map an external ipaddress (i have no more free ipaddres atm) to the openvpn machine

one solution would be running openvpn on the same revproxy machine, but i liked the idea to have a separate openvpn server

another way i've found in the meanwhile could be what is suggested in the last comment here by "mgorven" (but quite a complicated one i think) http://serverfault.com/questions/419783/iptables-how-to-redirect-forward-traffic-without-traffic-through-server

that said, i would like to learn best practices from anyone so feel free to suggest any idea!

Thanks, a lot, Marco