Pass QoS/ToS packets through two layers of OpenVPN??

dburr

First, sorry if this post is inappropriate for this forum. From my read-through of the forums this seemed to me to be the best place for it. But if I am mistaken, then please let me know.

I am using a slightly modified version of mirimir's dual-VPN isolation system to enhance my privacy and anonymity on the web. If you had told me about this a year ago I would have laughed at you and/or handed you a tinfoil hat. But given recent revelations this level of paranoia doesn't seem so ridiculous any more...

Basically this setup involves two separate VPN providers. One VPN, which I'll refer to as the "host VPN" (my own terminology) runs on your actual computer (in my case a PC running Ubuntu). The second VPN, which I'll refer to as the "client VPN," runs within a Virtual Machine (in my case, the virtual machine is also running Ubuntu Linux) The idea is that you do your actual work (browsing, email, chat, file transfer, whatever) completely within the virtual machine, and that combined with the double VPN isolates you and makes it that much harder for people to trace you and/or obtain your identity, etc. The idea is that you can create as many virtual machines as you want, to further compartmentalize your online activities (e.g. one virtual machine dedicated to email, another dedicated to online banking, etc.)

Here is a series of white papers describing this setup in more details.

https://www.ivpn.net/blog/privacy-guides

Specifically I have put together a system according to the steps detailed in part 2 of his guides, with the exception of not using Tor (I felt that the system, minus Tor, was "good enough" and that Tor would just add too much additional slowness/latency without a significant enough gain in security to justify the additional latency. Besides, I'm not *that* paranoid... yet... ;-) ). I am using Ubuntu 12.04 LTS as the OS for both the host and virtual machine, and both of the VPN providers I am using use OpenVPN.

The system is working great for general web browsing, email, etc. However I would like to set up ToS/QoS so that I can prioritize certain types of traffic (file uploads, voice chat, etc.)

Within the virtual machine, I have setup the appropriate Linux firewall rules, kernel traffic control (tc), etc. to enable QoS, and after adding the "passtos" flag to openvpn running in the VM, I see that the ToS bits are being passed through the first (inner/client) layer of VPN. However try as I might, I can't seem to get ToS passed through the second (outer/host) layer of VPN and out onto my LAN.

Unfortunately I've hit the limit of my knowledge of networking, so I have no idea how to proceed. Is the setup I am trying to achieve (passing ToS through multiple layers of OpenVPN) even possible? If so how would I go about setting it up?

Thanks in advance for any help and/or advice you can provide.

dburr

Bump... unfortunately Real Life has intervened lately and I haven't had a chance to monitor this thread. I would still like to get this working if possible.

As suggested here are my VPN configs.

Outer layer VPN config file (running directly on the Linux host):

client
dev tun
proto udp
remote IP.OF.VPN.SERVER 443
resolv-retry infinite
nobind
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
explicit-exit-notify 5
passtos
ca "ca.crt"
cert "user.crt"
key "user.key"

Inner layer VPN config file (running on the Virtual Machine):

script-security 2
client
dev tun
proto udp
route-delay 10
comp-lzo no
tls-auth ta.key 1
sndbuf 131072
rcvbuf 131072
nobind
cipher AES-128-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
remote IP.OF.VPN.SERVER1 443
remote IP.OF.VPN.SERVER2 443
nobind
persist-key
keepalive 3 10
ns-cert-type server
verb 1
mute 20
passtos
ca ca.crt
cert client.crt
key client.key

I have set up iptables rules on the inner VPN and have verified that TOS is being properly set where I want it to be, and it is being passed through the first VPN. However it gets no farther than that.