Hello,
I'm trying to build a VPN with a client being a router to the internet. Here is how I see the network :
(I make the distinction between VPN Client, Client, VPN Server and Server)
VPN Clients and VPN Server are in the 172.30.0.0/15 network
Clients are in the 172.30.0.0/16 part, Servers in the 172.31.0.0/16 part
Here is my basic IP configuration :
topology subnet
#IPv4
ifconfig 172.31.255.253 255.254.0.0
ifconfig-pool 172.30.0.1 172.30.255.255
#IPV6
ifconfig-ipv6 <IPv6 64 bit length prefix>:8000::fffe ffff:ffff:ffff:ffff:8::
ifconfig-ipv6-pool <IPv6 64 bit length prefix>:8000::/65
client-to-client
The thing is that, before, I was using my VPN Server as a router, and using NAT, I was accessing the Internet.
But now, I want to use a proxy, and I'm using a server, which is a VPN Client as a router.
It's configuration is :
172.31.255.254/15
<IPv6 64 bit length prefix>:8000::ffff/65
I don't push any route, I don't use any route command in the config, because I'm using a special routing table with following ip rules :
32762: from all oif tun0 lookup vpn
32763: from all iif tun0 lookup vpn
(Same thing for IPv6, if you wonder)
And here is my IPv4 Routing table :
default via 172.31.255.254 dev tun0
172.30.0.0/15 dev tun0 scope link src 172.31.255.253
For my clients, I only push this :
push "route-gateway 172.31.255.254"
push "redirect-gateway def1 ipv6"
On my router, I ignore the redirect-gateway command.
Masquerade and Iptables are also configured, we'll see it later.
For now, I will only talk of IPv4, before trying to use IPv6.
If my router receives a frame from tun0, from any client of the VPN :
1.1.1.1 from 172.31.255.253 via <Public IP> dev enp1s0f0
cache iif tun0
Routing is enabled :
net.ipv4.ip_forward = 1
Iptables chains :
Chain FORWARD (policy ACCEPT)
target prot opt source destination
OpenVPN-Routing all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain OpenVPN-Routing (1 references)
target prot opt source destination
ACCEPT all -- anywhere 172.30.0.0/15
ACCEPT all -- 172.30.0.0/15 anywhere
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.30.0.0/15 anywhere
So my VPN Client/Router seems configured.
Now, let's talk of my client :
heliodixy@HelioPC:~$ ip route get 1.1.1.1
1.1.1.1 via 172.31.255.254 dev tun0 src 172.30.0.2 uid 1000
cache
My client is ok, it knows that it must use the router as a gateway.
My problem comes from my VPN Server.
Here is the behaviour that I should have :
tech@vpn-server:/etc/openvpn$ sudo ip route get 1.1.1.1 from 172.30.0.2 iif tun0
1.1.1.1 from 172.30.0.2 via 172.31.255.254 dev tun0 table vpn
cache <redirect> iif tun0
My problem is that I can't ping 1.1.1.1 with my client, or my VPN Server.
I'm using tshark in order to know from where the problem comes.
- If I ping 172.31.255.253 from my client, the frames appears on the VPN Server and the ping succeeds.
If I ping 172.31.255.254 from my client, the frames appears on the Router and the ping succeeds.
If I ping 1.1.1.1 from my VPN Server, the frame doesn't appear on the Router and it fails
If I ping 1.1.1.1 from my Router, it works
If I ping 1.1.1.1 from my client, the ping appears on the VPN Server, but not on the router and it fails.
I think that something in OpenVPN blocks everything, and that it's not forwarded to the Router.
Does anyone have any idea ?
Thank you in advance
