Hi All,
Pretty unusual configuration I need to perform and would appreciate your suggestions. It is all for private use and "server" below is in fact my laptop in current location where I need to push traffic from one of VMs through the other geo location.
One host from OpenVPN server side (ip:192.168.100.100) traffic needs to be sent through OpenVPN server and client connected to it to get out to internet on client side.
Server (192.168.100.100) => LAN => OpenVPN Server (in docker) (192.168.250.1)=>(192.168.250.2) OpenVPN client (192.168.200.200) => LAN client side => it's default GW => internet
So far, using ip rule and custom ip route tables, I've managed to push traffic to OpenVPN server. This is where it gets stuck.
On Server side, I can see traffic on tun0 interface using tcpdump, but I can't see it on the "client" end on tun interface.
Traffic directed from Server (192.168.100.100) to Client side LAN (192.168.200.200) works fine.
Feeling is that it has something to do that OpenVPN client or server do not expect to process packets with destination IP anything else than what is on client side LAN.
This is effectively controlled by "route" command, but am not sure if adding "route 0.0.0.0 0.0.0.0" would be correct. This would need to be followed by iroute in ccd, but again, adding 0.0.0.0/0 smells to be dangerous with unknown effects.
One approach would be to test above in the lab but it would take quite an effort to build it and still it could be wrong. Testing it on live environment is no go.
Yet another approach is launching on the client side, server instance, and then creating additional OpenVPN client on the server side, i.e. in docker to become the router for the server and act as client to current OpenVPN client then acting as a server. This would bring another set of complication in terms of routing tables, etc.
Therefore the best would be to hear from you guys on best practices.
