Dear engineers,
I have built a topology:
CLIENT:tun0<->tun1:SRV1:tun0<->tun0:SRV2<?>Internet
SRV2 hosts a TUN-server with config including:
dev tun
proto tcp
port SRV2_PORT
server 10.0.2.0 255.255.255.0
route-up up_SRV2.sh
up_SRV2.sh:
ip route add 10.0.1.0/24 via 10.0.2.2 dev tun0
Also there is an iptables rule:
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o venet0 -j MASQUERADE
Finally, the
ip route output:
10.0.3.2 dev tun0 proto kernel scope link src 10.0.3.1
10.0.1.0/24 via 10.0.3.2 dev tun0
10.0.3.0/24 via 10.0.3.2 dev tun0
SRV1:tun0 has a client connection to SRV2 with config including:
dev tun0
remote SRV2_IP SRV2_PORT
proto tcp
script-security 3 system
route-up up_SRV1.sh
up_SRV1.sh:
ip route add default via 10.0.2.5 dev tun0 table xxx
ip rule add from 10.0.1.0/24 lookup xxx pref xxx
The config of the TUN-server listening on
SRV1:tun1:
dev tun1
proto tcp
server 10.0.1.0 255.255.255.0
push "redirect-gateway bypass-dhcp bypass-dns def1"
push "dhcp-option DNS 10.0.1.1"
ip route:
10.0.2.5 dev tun0 proto kernel scope link src 10.0.2.6
10.0.2.1 via 10.0.2.5 dev tun0
10.0.1.2 dev tun1 proto kernel scope link src 10.0.1.1
10.0.1.0/24 via 10.0.1.2 dev tun1
default dev venet0 scope link
ip route show table xxx:
default via 10.0.2.5 dev tun0
CLIENT:tun0 has a client connection to SRV1 with config including:
client
dev tun
proto tcp
remote SRV1_IP SRV1_PORT
ip route:
SRV1_IP dev venet0 scope link
10.0.1.5 dev tun0 proto kernel scope link src 10.0.1.6
10.0.1.1 via 10.0.1.5 dev tun0
default dev tun0 scope link
SRV2 pings:
ping 10.0.2.6 - working
ping 10.0.1.1 - not working
ping 10.0.1.6 - not working
SRV1 pings:
ping 10.0.2.1 - working
ping 10.0.1.6 - working
CLIENT pings:
ping 10.0.1.1 - not working (because of table 10 rule on SRV1)
ping 10.0.2.6 - working
ping 10.0.2.1 - not working
ping 8.8.8.8 - not working
The problem is that the traffic is not routed properly to 10.0.2.0/24 from CLIENT and back
The goal is to successfully route CLIENT to the Internet
Any ideas?
