Carry over source IP in IPSEC tunnel

bsilverwood

Here is what I am trying to do:

I have 2 AWS Virtual Private Clouds set up in two regions. I am trying to connect them with an OpenVPN IPSEC tunnel. I can get them to connect (using a connection between my NAT servers in each VPC, but it appears what server I use doesn't matter in my situation - I get the same results), HOWEVER On the far side of the connection it show that ALL traffic has a source of the IP address of the remote VPN connection.

This poses a problem for me. I need to still be able to see the original source IP address for the applications I am running (Nagios, GlusterFS, API server, etc...).

Is there a setting in the server config or the client config that will allow this to happen?

I think I just need to be pointed in the direction of where I need to dig into this information more. I assume it is a "simple" setting that I am missing for have mis-configured.

Thanks!

maikcat

I am trying to connect them with an OpenVPN IPSEC tunnel.

:shock:

which service are you using? openvpn OR IPSec?

Michael.

bsilverwood

Here is my server file if it helps to explain it more. I feel that I have been going down completely the wrong path here, haven't I?

# OpenVPN Server Config
port 1194
proto udp
dev tun

# Certificates
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/openvpn-server.crt
key /etc/openvpn/server/openvpn-server.key # This file should be kept secret
dh /etc/openvpn/server/dh1024.pem

server 172.16.20.0 255.255.255.0
push "route 172.16.0.0 255.255.0.0"
log-append /var/log/openvpn.vpc.log
verb 3
status /etc/openvpn/vpc_status.log
keepalive 20 100
persist-tun
persist-key

push "dhcp-option DNS 8.8.8.8"
client-to-client
client-config-dir /etc/openvpn/ccd
route 172.16.1.0 255.255.255.0

user nobody
group nobody
comp-lzo

bsilverwood

here is the config file for the client side:
# Sample OpenVPN configuration file using a pre-shared static key
# Port to use: 1194 is the official IANA port number
port 1195

# TCP or UDP server?
#proto tcp

# Use a dynamic tun device.
dev tun

# Remote peer and network
remote 54.208.127.134
# Routing for Prod/Dev Network
route 172.16.0.0 255.255.0.0

# Configure local and remote VPN endpoints
#ifconfig 169.254.255.2 169.254.255.1
ifconfig 172.17.40.225 172.16.30.225

# The pre-shared static key - keep it hidden. keep it safe.
secret /etc/openvpn/v2v/n1_n3.key

# Compress the packets
comp-lzo

# Make the link more persistant to connection failures
keepalive 10 60
ping-timer-rem
persist-tun
persist-key

maikcat

please you the following configs:

server

port 1194
proto udp
dev tun
# Certificates
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/openvpn-server.crt
key /etc/openvpn/server/openvpn-server.key # This file should be kept secret
dh /etc/openvpn/server/dh1024.pem
server 172.16.20.0 255.255.255.0
log-append /var/log/openvpn.vpc.log
verb 3
status /etc/openvpn/vpc_status.log
keepalive 20 100
persist-tun
persist-key
push "dhcp-option DNS 8.8.8.8"
client-to-client
client-config-dir /etc/openvpn/ccd
route 172.16.1.0 255.255.255.0
user nobody
group nobody
comp-lzo

your client config is really messed up...

create a client cert and use it for connecting to your server,
your current config is for point-to-point config using static key

ps: what IPSec has to do with openvpn????

Michael.