Ok. My main goal is to change routing all traffic from one tunnel to another without tcp session interruption.
Server:
First tunnel:
local [ip]
port 1194
proto tcp
dev tun1
keepalive 10 60
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
server 10.0.1.0 255.255.255.0
comp-lzo
Second tunnel:
local [ip]
port 1195
proto tcp
dev tun2
keepalive 10 60
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
server 10.0.2.0 255.255.255.0
comp-lzo
client:
first tunnel:
client
proto tcp
dev tun1
remote remoteip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/user1.crt
key /etc/openvpn/keys/user1.key
comp-lzo
second tunnel
client
proto tcp
dev tun2
remote remoteip 1195
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/user2.crt
key /etc/openvpn/keys/user2.key
comp-lzo
When both of tunnel are up i get such tun configuration:
12: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/[65534]
inet 10.0.1.6 peer 10.0.1.5/32 scope global tun1
13: tun2: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/[65534]
inet 10.0.2.6 peer 10.0.2.5/32 scope global tun2
I need to change routing from client to server transparently(without tcp session interruption), therefore i should not use 10.0.1.1 and 10.0.2.1
I set on the
server lo:0 as 192.168.1.1
ip add show lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet 192.168.2.1/32 brd 192.168.2.1 scope global lo:0
client:
ip addr show lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet 192.168.2.2/32 brd 192.168.2.2 scope global lo:0
client: ip route add 192.168.1.1/32 dev tun1 src 192.168.2.2
tcpdump on server doesn't show anything.