routing traffic of tun1 through tun0 to internet

jbodhorn

I've set up a personal vpn on my home network, I also pay for a vpn for privacy. I would like to route all the traffic from my personal vpn through the privacy vpn.

Is this something that can be done with just iptables? In my googling I haven't quite found what I'm looking for so I'm not sure if it's doable, I've seen people set one vpn as the gateway of the other but I haven't seen where just iptables were set

I would have a computer as a client behind a router connected to a server somewhere in the states for privacy as one instance of openvpn(tun0). I would also be running another instance of openvpn on that computer as my personal vpn server(tun1) which my(and my families) devices would connect to.

I think the biggest issue I'm going to have is that every time I connect to the privacy vpn the ip is different. I'm guessing I'll have to write a script to grab the ip and set the iptables and/or routing if I have to do that also.

If someone could point me in the right direction I'd greatly appreciate it

jbodhorn

I somehow posted this in the wrong section and don't see how to delete it....

Traffic

This is the correct board for your question:

You want to know how to route :

from your private VPN - as a Server
to a commercial VPN provider's VPN - as a client

This is a problem because the commercial VPN will redirect your default gateway
which breaks routing for your private VPN server.

It is a common problem but I do not know of a solution ..
It is not something that openvpn has provision for via openvpn configuration.

Perhaps somebody else here knows a solution but I have not seen one on this forum.

Pippin

jbodhorn wroteI've set up a personal vpn on my home network, I also pay for a vpn for privacy. I would like to route all the traffic from my personal vpn through the privacy vpn.

Run VPN through VPN?

I would have a computer as a client behind a router connected to a server somewhere in the states for privacy as one instance of openvpn(tun0). I would also be running another instance of openvpn on that computer as my personal vpn server(tun1) which my devices would connect to.
I think the biggest issue I'm going to have is that every time I connect to the privacy vpn the ip is different. I'm guessing I'll have to write a script to grab the ip and set the iptables and/or routing if I have to do that also.

Not sure but maybe a search for "multiple gateways" can shed some light...

Traffic

Pippin wroteRun VPN through VPN?

This is not the problem ..

Traffic wroteYou want to know how to route :
from your private VPN - as a Server
to a commercial VPN provider's VPN - as a client

So that a client connecting to the private VPN server can utilise the commercial VPN service to browse the internet etc.

Traffic wroteThis is a problem because the commercial VPN will redirect your default gateway
which breaks routing for your private VPN server.

I think it can be done but it is a quirky little problem ..

jbodhorn

Would I maybe be better off setting up a box with two ethernet ports and have one of those ports connected to the internet/modem and the privacy vpn, then use the other ethernet port to share internet to another box with my personal vpn server? ATM I'm looking for the most reliable way to set this up with as little script writing as possible. I'm not afraid of doing a little research or work, but if I'm going to have to write scripts so that every time I need to reconnect or reboot everything is automated they're gonna have to be quite basic.

I'm just not quite sure of the best route of attack for this project

ATM I have a raspberry pi set up as an access point that routes the traffic of the connected devices through the privacy vpn. It's only a raspberry pi and the usb wifi adapter broadcasting as an AP isn't the greatest, so I'm only getting an 8/8 connection. Anyway, I thought since that was so easy to set up and that I was able to just use iptables that chaining vpns together wouldn't be that much harder...

I'll do some searching on multiple gateways and see where that goes. I had planned on buying a router that supported vpn, but we recently got a new modem and it does not play nice with another router attached...

Traffic

jbodhorn wroteWould I maybe be better off setting up a box with two ethernet ports and have one of those ports connected to the internet/modem and the privacy vpn, then use the other ethernet port to share internet to another box with my personal vpn server?

The problem is that no matter where you use the commercial VPN client it will have its default gateway redirected (by the VPN server out of your control). I would think it will be easier to use the Pi as both server and client but you will have to write a fairly clever script to do the routing that the multiple VPNs would normally do automatically but which, for this use case, have conflicting interests.

jbodhorn

The pi was just a little project for fun, following a write up and a few searches got it working as good as it will. I'm looking to do something that's a bit more functional and can handle more traffic. If scripting is what I'll have to do I'll get it worked out eventually, I'm not in any rush to get this working, it just seemed like a great project to work on.

Until then I've at least got some useful info to research while I practice my script writing, I've only wrote a few quite basic scripts, I've been looking to expand my scripting knowledge anyway.

I read that using gateways to link/chain vpns together will limit the chain to two vpns, is that true and why? If two is all I can do that's fine for this project.

I've had this idea in my head for a while to set up vps in many locations and chain them together with openvpn to make something like a private tor to hide traffic and location. Is that not possible, would it be if I controlled all the servers, or is my roadblock(for my current project) just because I'm using a commercial vpn where I don't control the server?

Thank you much for your input, I wasn't sure if the gateways were the key to this or if I would just be setting iptables, imo iptables alone seemed like I was chasing a dream

Traffic

jbodhorn wroteis my roadblock(for my current project) just because I'm using a commercial vpn where I don't control the server?

That is the most troublesome obstacle ..

Where you do have control, you are free to test your knowledge (and openvpn) to the limit.

Pippin

How many concurrent connections with the same account does your VPN-provider allow?
Family needs to access your home but also be protected by VPN?

Some VPN-providers will allow you to connect back through VPN to your home.

VPN-client(s)<--->VPN-provider<--->VPN-homeclient

If this suites your need then just ask them, no need to fiddle around too much 😉

jbodhorn

Private Internet Access allows 5 connections per subscription, I personally have more than 5 devices that I connect to their vpn, not all at the same time obviously.

What if I were to host my vpn on a VM where the machine hosting the vpn server is connected to PIA or vice versa? I'm guessing this would be my best option as far as ease of setup goes, at least in regard to the amount of script writing required. Once I get past setting up vbox(unless someone recommends something better to use) headless and installing my vpn server on the VM I'll play around. I'm having some issues with vbox's extension packs and getting the proper pack installed atm and haven't gotten to play around with this idea yet... currently starting over with a new Ubuntu server install, I think I failed to properly remove a few things my first try and they were mucking thing up with vbox.

I'm fairly determined to do this, if for no other reason than to say I did it. But, I do want to learn to link vpn's together for various reasons, at this point though I think I should stop over at me ol mum's house and set up a vpn server there and use that to practice chaining vpn's. At least that way I would have two servers fully under my control.

Eventual goal is to set up multiple anonymous vps, each hosting an openvpn server and chaining the servers for privacy kinda like tor does. I'd like to have these servers set up like tor where each node knows as little as possible about the client and can't really divulge much info on its own. I think tor is a great idea but has become way too compromised, I'd like to make my own private network to keep me anonymous.