Would it be possible to do this with iptables? I've been playing around with that, and I definitely have them forwarding now, but it's still dead ending somewhere. Anyway, I realized the iptables I got from the 2nd guide I posted were incorrect for my situation, so I removed them all and then added the following:
sudo iptables -A INPUT -i lo -m comment --comment "loopback" -j ACCEPT
sudo iptables -A OUTPUT -o lo -m comment --comment "loopback" -j ACCEPT
sudo iptables -I INPUT -i tun0 -m comment --comment "In from Internal VPN" -j ACCEPT
sudo iptables -I OUTPUT -o tun1 -m comment --comment "Out to PIA" -j ACCEPT
sudo iptables -A OUTPUT -o tun0 -p udp --dport 1194 -m comment --comment "openvpn" -j ACCEPT
sudo iptables -A OUTPUT -o tun0 -p udp --dport 123 -m comment --comment "ntp" -j ACCEPT
sudo iptables -A OUTPUT -p UDP --dport 67:68 -m comment --comment "dhcp" -j ACCEPT
sudo iptables -A OUTPUT -o tun0 -p udp --dport 53 -m comment --comment "dns" -j ACCEPT
sudo iptables -A FORWARD -i tun1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o tun1 -m comment --comment "Internal VPN out to PIA" -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
and then ran this on the client:
$ curl http://google.com:22002
And tcpdump now shows this on the server:
$ sudo tcpdump -tttnei tun0 port 22002
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
00:00:00.000000 ip: 10.8.0.2.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:00.219789 ip: 10.8.0.2.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:03.168813 ip: 10.8.0.2.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:00.006512 ip: 10.8.0.2.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:05.606792 ip: 10.8.0.2.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 65535, options [mss 1306,nop,nop,sackOK], length 0
00:00:00.216793 ip: 10.8.0.2.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,nop,sackOK], length 0
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel
$ sudo tcpdump -tttnei tun1 port 22002
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 262144 bytes
00:00:00.000000 ip: 192.168.1.11.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:00.220061 ip: 192.168.1.11.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:03.168799 ip: 192.168.1.11.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:00.010287 ip: 192.168.1.11.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,wscale 8,nop,nop,sackOK], length 0
00:00:05.602914 ip: 192.168.1.11.61472 > 172.217.12.206.22002: Flags [S], seq 2773229053, win 65535, options [mss 1306,nop,nop,sackOK], length 0
00:00:00.216759 ip: 192.168.1.11.61474 > 172.217.12.206.22002: Flags [S], seq 3890823237, win 8192, options [mss 1306,nop,nop,sackOK], length 0
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel
So the query is coming into the server from ip 10.8.0.2 in tun0, which is the IP address my client laptop has been assigned by openVPN, and it looks like that is trying to go directly to google. But then I see in tun1 the IP address assigned to the server, and that is being sent to google as well. I mean... it certainly looks promising to me. What's your take? Thanks for the help, by the way.
