The firewall of my company is doing a forwarding to a Virtual IP address 10.0.1.50, the virtual address is set on two servers that are using keepalived, the first server is using the address 10.0.1.51 and the second is using the address 10.0. 1.52, in each of these servers I configured OpenVPN with the same keys. The problem is that when the request comes from the client (Internet) to VPN servers do not respond with the virtual IP, and they do with the IP which was initially configured (10.0.1.51 or 10.0.1.52) and then you can not establish the connection. I indicate that if I delete the keepalived configuration and directly to one of the servers put the address 10.0.1.50 then everything is connected without any problems.
Configurations:
balancer1 (/etc/network/interfaces) :
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eth0
iface eth0 inet manual
address 10.0.1.51
netmask 255.255.255.0
gateway 10.0.1.253
dns-nameservers 8.8.8.8
-----------------------------------------------------------------
balancer2 (/etc/network/interfaces) :
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eth0
iface eth0 inet manual
address 10.0.1.52
netmask 255.255.255.0
gateway 10.0.1.253
dns-nameservers 8.8.8.8
-----------------------------------------------------------------
Keepalive (/etc/keepalived/keepalived.conf) :
global_defs {
router_id haproxy1
}
vrrp_script haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}
vrrp_instance 50 {
virtual_router_id 50
advert_int 1
priority 101
state MASTER
interface eth0
virtual_ipaddress {
10.0.1.50/24 dev eth0
}
track_script {
haproxy
}
}
-----------------------------------------------------------------
OpenVPN server (/etc/openvpn/server.conf) :
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push route "10.0.1.51 255.255.255.255"
push route "10.0.1.53 255.255.255.255"
push route "10.0.1.54 255.255.255.255"
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
-----------------------------------------------------------------
OpenVPN client (/etc/openvpn/client.conf) :
client
proto udp
dev tun
float
remote 192.168.122.213
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/proxy.crt
key /etc/openvpn/keys/proxy.key
tls-client
tls-auth /etc/openvpn/keys/ta.key 1
auth SHA1
cipher BF-CBC
remote-cert-tls server
comp-lzo
verb 4
route-method exe
route-delay 2
