Avoiding DSLite by using VPS with OVPN to connect to homeserver

nimra98

Hi,

I need a few opinions on a project.
In a few months I will change my ISP. At the moment I do have a DualStack connection provided by Deutsche Telekom.
The fiber company, which is about to build their infrastructure here, only supports DSLite for private customers.
This is a huge problem for everyone having a server at home, which he needs to access from outside.
As long as every connection has IPv6-capability nothing would change. But IPv4-only Services (both: on the server and through a limited connection (for example public wifi)) can't be accessed caused by the NAT/CGN.

Therefore I thought about renting a virtual server as a Gateway. I imagined the following build:


|Internet| <--> |Virtual Server with OVPN Server| <--> |Homeserver with OVPN Client and IPv4 Services|

The VPS does have IPv4 AND IPv6. My domain would direct to this VPS and every package would be sent to a OpenVPN-tunnel to my homeserver.

Because I'm quite new to OpenVPN there are a lot of issues for me:

-Would it make sense to have the server installed on my homeserver instead of the VPS?
-Is OpenVPN fully capable of tunneling IPv4 and IPv6 through one connection?
-Where to place the Firewall? Directly on the VPS or as the last gate on my homeserver?

Has anyone set up anything equal?

Any thoughts?

Pippin

Yeah, the dreaded DS-Lite 🙂

Ok, not 100% educated opinion:

|Internet| <--> |Virtual Server with OVPN Server| <--> |Homeserver with OVPN Client and IPv4 Services|

1. Yes, that ^^^ way no need to fiddle with IPv6 I would think, Homeserver connects to VPS and so do your clients.

-Would it make sense to have the server installed on my homeserver instead of the VPS?

See 1.

-Is OpenVPN fully capable of tunneling IPv4 and IPv6 through one connection?

I think so, but probably no need because of 1.

-Where to place the Firewall? Directly on the VPS or as the last gate on my homeserver?

Both, because I think it`s good practice to have a firewall in place for just about anything that connect to internet.

nimra98

Thanks for your answer.
I will give it a try.

Another question: I imagine the OVPN-connection as a second "network interface", so that I can set up a firewall between OS/Software and connection. Possible?
And then naturally the question: TUN or TAP? I would tend to use TUN. Any problems with UDP traffic send through the tunnel?

vpnforward

Yes, tools like iptables can set firewall rules for the OVPN interface, whether TUN or TAP. TUN is going to be more bandwidth-efficient, and I have yet to experience issues with UDP over it.

From my own immediate experience, your OVPN client (your homeserver) will need to have a route for the internet clients _over_ the OVPN tunnel. That is, if you wish to connect to your services from arbitrary points on the internet, you will need to set a default route over the tunnel. If you know your external client IPs beforehand you could set a route for just them over the tunnel, but that gets complicated and sets you up to have asymmetric routing problems.

If you don't have the necessary route, you will likely encounter a situation where you see packets arriving on the OVPN interface, but silently dropping before your services see them (uRPF).