I'm trying to setup and old pc with linux (CentOS) as an access point to a VPN I have in another home. I have two ethernet interfaces, so I want to use one to connect to internet through my router, connect to my VPN and then share that VPN connection over my second ethernet. The ip on the second device should be assigned by DHCP.
I've been reading lots of tutorials/posts, and I was able to share my plain internet connection, with my VPN down. However, once I start the VPN, no matter what my iptables/routes rules are, I'm stuck with no internet in my second device. I'm clueless about what I'm doing wrong. Could someone provide some help?
Here are my configurations:
- enp2s0: this is connected to my main router.
- enp0s29f7u1: this will be connected to a second device
enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether bc:ee:7b:19:89:68 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.26/24 brd 192.168.1.255 scope global noprefixroute enp2s0
valid_lft forever preferred_lft forever
inet6 fe80::c25c:2c9d:4777:79fc/64 scope link noprefixroute
valid_lft forever preferred_lft forever
enp0s29f7u1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast stat e UP group default qlen 1000
link/ether 00:e0:4c:69:35:d0 brd ff:ff:ff:ff:ff:ff
inet 10.8.0.5/24 brd 10.8.0.255 scope global noprefixroute enp0s29f7u1
valid_lft forever preferred_lft forever
inet6 fe80::2e0:4cff:fe69:35d0/64 scope link
valid_lft forever preferred_lft forever
Once I connect to my VPN, there is another interface, tun0:
tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::2d75:64c0:6c21:c9d9/64 scope link flags 800
valid_lft forever preferred_lft forever
My /etc/dhcp/dhcpd.conf has the following options:
subnet 10.8.0.0 netmask 255.255.255.0 {
range 10.8.0.10 10.8.0.15;
option routers 10.8.0.5;
option domain-name-servers 8.8.8.8, 8.8.4.4;
}
The second device is getting 10.8.0.11 as ip, so I guess its working fine.
I've added the following rules using iptables:
iptables -t nat -I POSTROUTING 1 -o tun0 -j MASQUERADE
iptables -I FORWARD 1 -i tun0 -o enp0s29f7u1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD 1 -i enp0s29f7u1 -o tun0 -j ACCEPT
Additional information:
- I do have ip4 forwarding enabled:
/sbin/sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
- I can access internet with the ip from my VPN server in another home as expected. However, I can only do it from the computer in which im setting up this configuration, not from the device connected through `enp0s29f7u1`.
- This are the routes before/after launching the vpn.
BEFORE
ip route
default via 192.168.1.1 dev enp2s0 proto static metric 101
10.8.0.0/24 dev enp0s29f7u1 proto kernel scope link src 10.8.0.5 metric 100
AFTER
ip route
0.0.0.0/1 via 10.8.0.1 dev tun0
default via 192.168.1.1 dev enp2s0 proto static metric 101
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
10.8.0.0/24 dev enp0s29f7u1 proto kernel scope link src 10.8.0.5 metric 100
xx.xx.xx.xx via 192.168.1.1 dev enp2s0
128.0.0.0/1 via 10.8.0.1 dev tun0
192.168.1.0/24 dev enp2s0 proto kernel scope link src 192.168.1.26 metric 101
192.168.1.0/24 dev enp2s0 proto kernel scope link src 192.168.1.26 metric 101
I've replaced my VPN server public ip by xx.xx.xx.xx
What am I missing here?
EDIT: Out of desperation, I tried to bridge interfaces, even if I knew it wasn't a great idea. It didn't work either.
