marcovillar
Hey, I really hope someone can help me with this small issue i am having :/
ok what i am trying to do is I have a client to connect to a dedicated openvpn centos server in a datacenter who is already connect to another vpn server in a different datacenter (with openvpn)
so client->vpn_relay->vpn_server
i have my client config as :
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote 43.XX.XX.XX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
ca ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/clt.crt
key /etc/openvpn/easy-rsa/pki/private/clt.key
---------------
this connect perfectly to the vpnrelay which is a server and a client himself
the config for the vpn_relay_server is:
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca1.crt
cert server1.crt
key server1.key
dh dh1.pem
topology subnet
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status1.log
verb 3
crl-verify /etc/openvpn/easy-rsa/pki/crl.pem
-------------
now on the vpn_relay i have a client.conf as well to connect to the vpn_server on different datacenter which is:
client
dev tun
proto udp
remote 151.XX.XX.XX 7098
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
ca ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/serverclt.crt
key /etc/openvpn/easy-rsa/pki/private/serverclt.key
--------------------------
and the last config is is the vpn_server which is:
local 151.XX.XX.XX
port 7098
proto udp
dev tun
auth-nocache
ca ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
status openvpn-status.log
verb 3
client-to-client
----------------------------
now client to vpn_relay works great!
vpn_relay to vpn_server works great!
but when i connect with client to vpn_relay i cant figure out how to make him get the vpn_server ip
i tried both route add and the ifconfig please someone help:/
obviously the problem lay with vpn_relay so i will focus on that
here is the iptables rules i tried and failed and the output of the ifconfig
eth0 Link encap:Ethernet HWaddr 00:16:3C:F4:42:B8
inet addr:43.XX.XX.XX Bcast:43.XX.XX.XX Mask:255.255.255.192
inet6 addr: fe80::216:3cff:fef4:42b8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:15637749 errors:0 dropped:0 overruns:0 frame:0
TX packets:676160 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1729954325 (1.6 GiB) TX bytes:422608729 (403.0 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:58 errors:0 dropped:0 overruns:0 frame:0
TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4936 (4.8 KiB) TX bytes:4936 (4.8 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.1.1 P-t-P:10.8.1.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
------------------------------
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -s 10.8.1.0/24 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -j SNAT --to 10.8.0.6
not working so i tried (i tried also adding iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -j SNAT --to 10.8.0.5 with same result)
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
not working
so i tried to add a route
route add -net 10.8.1.0 netmask 255.255.255.0 gw 10.8.0.6
not working:/ (tried also adding route add -net 10.8.1.0 netmask 255.255.255.0 gw 10.8.0.5 with same result)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
43.XX.XX.XX 0.0.0.0 255.255.255.192 U 0 0 0 eth0
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun1
10.8.1.0 10.8.0.6 255.255.255.0 UG 0 0 0 tun1
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
0.0.0.0 43.XX.XX.XX 0.0.0.0 UG 0 0 0 eth0
Can someone please help?
Thanks Marco
P.S. i wanted to add push "redirect-gateway def1" to the vpn_server but i am scared it will make my vpn_relay not reachable to the client since of the changing ips.
