OpenVPN Client as gateway

zombie77

Hello at all,

i can find a lot of tutorials about using a OpenVPN server as a gateway, but not the other way around: using a OpenVPN Client as a gateway for the server. I was working on this problem for days but now i gave up. I hope I can find help in this forum . 😉

My Setup:
My server at home has a public ipv4 address but a private static ipv6 address. I rented a root server with a private static ipv4 address, which should be the gateway for my home-server. Both are running ubuntu 14.04. I created a VPN Tunnel on ipv6 where my home-server is the server and the root server is the client. This is working so far.
On the client I created NAT rules and turned ip-forwarding on (see config below). On the server i replaced the default route with a route via the client. But when doing that, my server can't make any connection to the internet. But all incomming connections work fine. Has anybody an idea how to fix the problem?

My config:

Server:

root@Homeserver:~# ifconfig
em1       Link encap:Ethernet  Hardware Adresse 00:26:xx:xx:xx:xx  
          inet Adresse:192.168.2.2  Bcast:192.168.2.255  Maske:255.255.255.0
          inet6-Adresse: 2a00:61e0:xxxx:xxxx:xxxx:xxxx:xxxx:aad1/64 GÃ¼ltigkeitsbereich:Global
          inet6-Adresse: fe80::xxxx:xxxx:xxxx:xxxx:xxxx:aad1/64 GÃ¼ltigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:1466 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 Fenster:0
          TX-Pakete:1396 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 TrÃ¤ger:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:1000 
          RX-Bytes:259601 (259.6 KB)  TX-Bytes:314944 (314.9 KB)

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 GÃ¼ltigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:65536  Metrik:1
          RX-Pakete:145 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 Fenster:0
          TX-Pakete:145 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 TrÃ¤ger:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:0 
          RX-Bytes:13709 (13.7 KB)  TX-Bytes:13709 (13.7 KB)

tun0      Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet Adresse:10.8.0.1  P-z-P:10.8.0.2  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:613 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 Fenster:0
          TX-Pakete:571 Fehler:0 Verloren:0 ÃberlÃ¤ufe:0 TrÃ¤ger:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:100 
          RX-Bytes:45163 (45.1 KB)  TX-Bytes:151980 (151.9 KB)

root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# ip route
default via 192.168.2.1 dev em1 
10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
192.168.2.0/24 dev em1  proto kernel  scope link  src 192.168.2.2 
root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# iptables -vL
Chain INPUT (policy ACCEPT 232 packets, 17954 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 187 packets, 20872 bytes)
 pkts bytes target     prot opt in     out     source               destination         
root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# 
root@Homeserver:~# iptables -t nat -vL
Chain PREROUTING (policy ACCEPT 62 packets, 5149 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 50 packets, 2326 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
root@Homeserver:~# 
root@Homeserver:~#
root@Homeserver:~#  
root@Homeserver:~# traceroute -m4 google.com
traceroute to google.com (173.194.113.97), 4 hops max, 60 byte packets
 1  192.168.2.1 (192.168.2.1)  0.500 ms  0.539 ms  0.586 ms
 2  100.65.128.1 (100.65.128.1)  2.490 ms  2.496 ms  2.541 ms
 3  185.xxx.xxx.3 (185.xxx.xxx.3)  7.404 ms  7.443 ms  7.497 ms
 4  185.xxx.xxx.2 (185.xxx.xxx.2)  8.176 ms  8.567 ms  8.558 ms

Client:

root@vps104494:~# ifconfig
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:296 (296.0 B)  TX bytes:296 (296.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:14138 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15240 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:3167471 (3.1 MB)  TX bytes:2108397 (2.1 MB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: 2001:41d0:xxxx:xxxx:xxxx:xxxx:xxxx:38d/56 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:31042 errors:0 dropped:0 overruns:0 frame:0
          TX packets:30022 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6666409 (6.6 MB)  TX bytes:6669485 (6.6 MB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:92.xxx.xxx.199  P-t-P:92.xxx.xxx.199  Bcast:92.xxx.xxx.255  Mask:255.255.255.0
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# ip route
10.8.0.1 via 10.8.0.9 dev tun0 
10.8.0.9 dev tun0  proto kernel  scope link  src 10.8.0.10 
92.xxx.xxx.0/24 dev venet0  proto kernel  scope link  src 92.xxx.xxx.199 
default dev venet0  scope link 
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# iptables -vL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 1005 packets, 173K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# iptables -t nat -vL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 3648  140K DNAT       all  --  any    any     anywhere             92.xxx.xxx.199    to:10.8.0.1

Chain POSTROUTING (policy ACCEPT 23 packets, 840 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    venet0  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination  
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# 
root@vps104494:~# traceroute -m4 google.com
traceroute to google.com (173.194.67.100), 4 hops max, 60 byte packets
 1  105.ip-37-187-37.eu (37.187.37.105)  0.060 ms  0.016 ms  0.019 ms
 2  rbx-g2-a9.fr.eu (178.33.100.137)  1.375 ms  1.364 ms  1.392 ms
 3  * * *
 4  fra-5-6k.fr.eu (94.23.122.218)  8.796 ms * *

After changing the routing at the server:

root@Homeserver:~# route del default 
root@Homeserver:~# route add 10.8.0.10 dev tun0
root@Homeserver:~# route add default gw 10.8.0.10
root@Homeserver:~# 
root@Homeserver:~# ip route
default via 10.8.0.10 dev tun0 
10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
10.8.0.10 dev tun0  scope link 
192.168.2.0/24 dev em1  proto kernel  scope link  src 192.168.2.2 
root@Homeserver:~# 
root@Homeserver:~# traceroute -m4 google.com
google.com: Der Name oder der Dienst ist nicht bekannt
Cannot handle "host" cmdline arg `google.com' on position 1 (argc 2)
root@Homeserver:~# 
root@Homeserver:~# traceroute -m4 173.194.113.97
traceroute to 173.194.113.97 (173.194.113.97), 4 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
root@Homeserver:~# 
root@Homeserver:~# ping 10.8.0.10
PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.
64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=25.8 ms
^C
--- 10.8.0.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 25.861/25.861/25.861/0.000 ms

And here is a picture of what I'm trying to do:

Traffic

zombie77 wroteOn the server i replaced the default route with a route via the client. But when doing that, my server can't make any connection to the internet

You can not redirect your server side gateway to a VPN client ..

zombie77

That would be really bad 🙁
Can you maybe please explain why this is not possible? Did you noticed, that my VPN Tunnel is based on ipv6? So the Tunnel is not effected from changing the ipv4 routes.