Hello, my ISP only gives me an IPv6 for my Home network so I cant reach it via IPv4 from the outside. My solution is to rent a VPS that has an IPv4 and an IPv6 and to set up a double VPN tunnel. My Laptop connects via mobile internet (IPv4) to the VPS and the VPS is connected via IPv6 to my server at home. Inside the tunnel everything is IPv4. The setup and the connection of this setup is working, but I have my problems with the routing. My home network is 192.168.178.0/24, my IPv6 tunnel is 192.168.2.0/24 and my IPv4 tunnel is 192.168.3.0/24. Here are my configs: IPv6 tunnel: Server: [code]server 192.168.2.0 255.255.255.0 port 1194 proto udp6 dev tun0 ca certs/ca.crt cert certs/server.crt key certs/server.key dh certs/dh2048.pem client-to-client cipher AES-256-CBC push "route 192.168.178.0 255.255.255.0" route 192.168.2.0 255.255.255.0 192.168.178.1 1 ping-timer-rem keepalive 20 180 verb 3 mute 50[/code] client: [code]client remote 2001:a61:1117:3c01:d250:99ff:fe47:8e5a 1194 proto udp6 dev tun0 ca certs/client/ca.crt cert certs/client/client.crt key certs/client/client.key ns-cert-type server cipher AES-256-CBC verb 3 mute 50[/code] IPv4 tunnel: Server: [code]server 192.168.3.0 255.255.255.0 port 1195 proto udp6 dev tun1 ca certs/server/ca.crt cert certs/server/server.crt key certs/server/server.key dh certs/server/dh2048.pem client-to-client cipher AES-256-CBC push "route 192.168.2.0 255.255.255.0 192.168.3.1 1" push "route 192.168.178.0 255.255.255.0 192.168.3.1 1" ping-timer-rem keepalive 20 180 verb 3 mute 50 log-append /var/log/openvpn/server.log[/code] Client: [code]client remote 2a06:1c40::49e 1195 proto udp6 dev tun0 ca certs/NAS/ca.crt cert certs/NAS/Jan-PC.crt key certs/NAS/Jan-PC.key ns-cert-type server cipher AES-256-CBC verb 3 mute 50 [/code] Can anybody tell me what I'm doing wrong with my routing?

You appear to have missed a step, namely the --[b]iroute[/b] for client subnets. Your home server does not know about client routes on your VPS server. See this HOWTO: [url]https://openvpn.net/index.php/open-source/documentation/howto.html#scope[/url] Another approach would be to have both your servers run on the VPS and make your home network a client instead of a server node. Or you could use --[b]topology p2p[/b] thereby avoiding the need of --[b]iroute[/b]

Routing Problems with double VPN tunnel

SuperManitu

Hello,
my ISP only gives me an IPv6 for my Home network so I cant reach it via IPv4 from the outside. My solution is to rent a VPS that has an IPv4 and an IPv6 and to set up a double VPN tunnel. My Laptop connects via mobile internet (IPv4) to the VPS and the VPS is connected via IPv6 to my server at home. Inside the tunnel everything is IPv4. The setup and the connection of this setup is working, but I have my problems with the routing. My home network is 192.168.178.0/24, my IPv6 tunnel is 192.168.2.0/24 and my IPv4 tunnel is 192.168.3.0/24.
Here are my configs:
IPv6 tunnel:
Server:

server 192.168.2.0 255.255.255.0

port 1194
proto udp6
dev tun0

ca certs/ca.crt
cert certs/server.crt
key certs/server.key
dh certs/dh2048.pem

client-to-client
cipher AES-256-CBC

push "route 192.168.178.0 255.255.255.0"
route 192.168.2.0 255.255.255.0 192.168.178.1 1

ping-timer-rem
keepalive 20 180

verb 3
mute 50

client:

client

remote 2001:a61:1117:3c01:d250:99ff:fe47:8e5a 1194
proto udp6
dev tun0

ca certs/client/ca.crt
cert certs/client/client.crt
key certs/client/client.key
ns-cert-type server

cipher AES-256-CBC

verb 3
mute 50

IPv4 tunnel:
Server:

server 192.168.3.0 255.255.255.0

port 1195
proto udp6
dev tun1

ca certs/server/ca.crt
cert certs/server/server.crt
key certs/server/server.key
dh certs/server/dh2048.pem

client-to-client
cipher AES-256-CBC

push "route 192.168.2.0 255.255.255.0 192.168.3.1 1"
push "route 192.168.178.0 255.255.255.0 192.168.3.1 1"

ping-timer-rem
keepalive 20 180

verb 3
mute 50

log-append /var/log/openvpn/server.log

Client:

client
remote 2a06:1c40::49e 1195
proto udp6
dev tun0

ca certs/NAS/ca.crt
cert certs/NAS/Jan-PC.crt
key certs/NAS/Jan-PC.key
ns-cert-type server
cipher AES-256-CBC

verb 3
mute 50

Can anybody tell me what I'm doing wrong with my routing?

Traffic

You appear to have missed a step, namely the --iroute for client subnets.
Your home server does not know about client routes on your VPS server.

See this HOWTO:
https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Another approach would be to have both your servers run on the VPS and make your home network a client instead of a server node.

Or you could use --topology p2p thereby avoiding the need of --iroute

SuperManitu

I'm not sure if I misunderstood your tip, but I dont want to be able to ping my Laptop (Roadwarrior) from my home network, I want to ping my home network from my Laptop.
The VPS in the middle should simply forward the packages destinated to 192.168.178.0/24 to my IPv6 VPN Server who can then route them in the home network (but I dont know how to do this).

SuperManitu

I'm not sure if I understand that right, but I dont want to be able to ping from my home network to my laptop, only the other way round.
So

Laptop -----IPv4-----> VPS ----IPv6----> Server (in home network) ------Ipv6/4------> Home Network
192.168.2.0/24 192.168.3.0/24 192.168.178.0/24

SO i have to route the packages from the Laptop to 192.168.178.1 (my Router in my home network). But this doesnt work.

SuperManitu

Im not sure if I understand that, but I only want to route the packages from my Latop to 197.168.178.1 (my router)

SuperManitu

I dont want to get from the server to the client, only the other way round.

The problem is the routing at the VPS. Here is a traceroute from my client:

C:\Users\Jan>tracert 192.168.2.1

Routenverfolgung zu 192.168.2.1 über maximal 30 Hops

  1    35 ms    35 ms    34 ms  192.168.3.1
  2     *        *        *     Zeitüberschreitung der Anforderung.
  3     *        *        *     Zeitüberschreitung der Anforderung.
  4  ^C

You'll see that it routes correctly to the VPS, but then it cant hop further.

ip route on my VPS:

root@JanCo-IT-Testserver:~# ip route
192.168.3.2 dev tun1  proto kernel  scope link  src 192.168.3.1
192.168.2.1 via 192.168.2.5 dev tun0
192.168.2.5 dev tun0  proto kernel  scope link  src 192.168.2.6
192.168.178.0/24 via 192.168.2.5 dev tun0
192.168.3.0/24 via 192.168.3.2 dev tun1
default dev venet0  scope link

The server on the VPS:

server 192.168.3.0 255.255.255.0

port 1195
proto udp
dev tun1

ca certs/server/ca.crt
cert certs/server/server.crt
key certs/server/server.key
dh certs/server/dh2048.pem

client-config-dir ccd
cipher AES-256-CBC

push "route 192.168.2.0 255.255.255.0"
push "route 192.168.178.0 255.255.255.0"

ping-timer-rem
keepalive 20 180

verb 3
mute 50

log-append /var/log/openvpn/server.log

The client on the VPS:

client

remote nas-vanbruegge.dynv6.net 1194
proto udp6
dev tun0

ca certs/client/ca.crt
cert certs/client/client.crt
key certs/client/client.key
ns-cert-type server

cipher AES-256-CBC

verb 3
mute 50

log-append /var/log/openvpn/client.log

The home server has the same config as the VPS except that he has other routing commands:

push "route 192.168.178.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
route 192.168.178.0 255.255.255.0 192.168.178.1 1

The last command is because I want to get the other clients in the network and .1 is my router.
Any idea?

SuperManitu

I finally solved the problem, I had to add a masquerading command to iptables:

iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d 192.168.2.0/24 -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d 192.168.178.0/24 -o tun0 -j MASQUERADE

After running those i was able to ping and traceroute 192.168.2.1 without problems.