Tunnel/ Route all traffic for one IP (out of four) with OVPN

MaKess

Hi everyone

Along with my root-server I got a bunch of IPs.
More precisely: One primary IP (bound to eth0) and three other ones that are routed to the interface of the primary one (accessed through pseudo-interfaces eth0:0, eth0:1, eth0:2).
ifconfig gives me something like that (ip and mac addresses are not the real ones):

eth0      Link encap:Ethernet  Hardware Adresse 1a:2b:3c:4d:5e:6f
          inet Adresse: 90.80.70.60  Bcast:90.80.70.255  Maske:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:79121 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68715 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX bytes:10727214 (10.7 MB)  TX bytes:18570446 (18.5 MB)
          Interrupt:19 Basisadresse:0x2000 

eth0:0    Link encap:Ethernet  Hardware Adresse 1a:2b:3c:4d:5e:6f
          inet Adresse:90.80.70.50  Bcast:94.255.255.255  Maske:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          Interrupt:19 Basisadresse:0x2000 

eth0:1    Link encap:Ethernet  Hardware Adresse 1a:2b:3c:4d:5e:6f
          inet Adresse:90.80.70.51  Bcast:94.255.255.255  Maske:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          Interrupt:19 Basisadresse:0x2000 

eth0:2    Link encap:Ethernet  Hardware Adresse 1a:2b:3c:4d:5e:6f
          inet Adresse:90.80.70.52  Bcast:94.255.255.255  Maske:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          Interrupt:19 Basisadresse:0x2000

lo        ...normal stuff...

Because I don't need all of them for the server, I want to use one of the IPs (let's say the last one: 90.80.70.52) to provide a public and static IP to a machine (let's call it "homebox") which is connected via a normal dynamic-ip dsl connection to the internet.
The Idea was to set up OpenVPN on the server which would capture all incoming IP-Packages for 90.80.70.52 and send them through a VPN-tunnel to "homebox"
Homebox on the other end should get a (virtual) interface with 90.80.70.52 as the assigned IP-address

Can someone give me some pointers how I can do that?

Some questions/restrictions I thought about:
- I don't want to use NAT: The interface at the homebox should have 90.80.70.52 as the address and NOT 10.1.2.3 or something like that
- Can this be done with a routing (tun) interface?
- Or is there a bridging (tap) interface necessary?
- For Reasons of saving bandwith, ONLY packages pointing at 90.80.70.52 should go through the tunnel. Everything else hitting the server is either used by the server itself (meaning: the other three IPs or can be discarded/ dropped)

Thanks a lot in advance,
Martin

Bebop

MaKess wroteI don't want to use NAT: The interface at the homebox should have 90.80.70.52 as the address and NOT 10.1.2.3 or something like that

Be more specific. If you mean what I think you mean, then what you're asking is impossible. If your homebox has public 90.80.70.52 AND your server has public 90.80.70.52, then what happens when someone sends a ping to 90.80.70.52? Does it go to homebox or does it go to your server?

You need NAT for this. Your homebox can masquerade as 90.80.70.52, but all traffic will be via NAT / server.

MaKess

Here is sketch of how I try to get the whole thing set up:

@Bebop
ALL Packages destined for 90.80.70.52 (regardless of the Protocol TCP, UDP, ICMP, ...) are sent through the tunnel/ virtual connection and evaluated by homebox.
An echo request aka. "ping" would therefore just be forwarded to the homebox, too.
There wouldn't be any local Interface (eth0:2) at the server "responsible" for 90.80.70.52 any more.

The server would act as a router. Instead of sending the packages out again through a local interface, it would just forward the packages to homebox.
Therefore if the whole thing works and someone does a traceroute, this is what it might look like:

...
7   90.80.70.1 <last router in front of the server>
8   90.80.70.60 <server>
9   90.80.70.52 <homebox>

Martin

Mimiko

As Bebop said, you will DNAT anyway. Because you have a public network IP assigned with 90.80.70.X (I guess so).

Another thing I would try, create a virtual interface on Homebox with IP 90.80.70.52, delete that interface on your server, and add with iproute a route from internet do this ip forward packets thru the tunnel and use metric 1 to be this route in first to capture packets for your desired IP. I don't know how to write this in linux, but in windows it will be something like:

route add 90.80.70.52 mask 255.255.255.255 gateway a.b.c.d metric 1

where a.b.c.d will be your OpenVPN server's tap driver adpater's ip when yo will define it in config file.

For the tunnel in OpenVPN you will have to assign privet ip in config file to make the tunnel working.

Bebop

Nice sketch martin. That makes things *so* much easier to work with. I'm with Mimiko on this one. If you need some help with the Linux part of it lemme know.

MaKess

First: Thanks to both of you!

@Bebop
Thanks a lot, I really would appreciate your help.
Both, the server and homebox are linux machines.
I haven't used tap-devices yet. (just tun, and as you can see on the left, I'm still a OpenVPN Newbie)
What is there to be done with iptables and/or routing-tables?
At which point are the addresses assigned to the interfaces? Is this something I can put in the OpenVPN config files or is that to be done by a script after the tunnel is up?

Martin

Mimiko

First off al, setup your OpenVPN tunnel. There are example.ovpn files, which you can use to modify for your needs. You can make a tunnel with routing method using point-to-point option or multi-client option.

When you will have the tunnel working, you can add virtual adapter on your homebox and delete the wanted IP from server, and using iproute command in linux route packets for desired external IP to and from tunnel.

Bebop

Mimi has more knowledge about the route specific parts, and deciding the first things to do. I will be available for the Linux specific bits and iptables. I like how you know what you want very clearly, so I do look forward to helping out. Guides here (Centos) and here (Debian) are good. Stuff like certificates vs pam (user / pass) for authentication would be best decided some time at the start too.