Hi All,
I am running OpenVPN 2.2.1 on OBSD 4.9. I am connected to two ISPs (i.e. I have two external IPs), and I need my OpenVPN to respond adequately on requests to both of the IPs. My problem is that I cannot do that with PF. Let's consider the following scenario:
Default gateway is ISP1 (1.1.1.1, reachable through e1)
an OpenVPN session request arrives on e1, with a dest IP of 1.1.1.5 and an openVPN reply is sent through
e1, with a source IP of 1.1.1.5
an OpenVPN session request arrives on e2, with a dest IP of 2.2.2.5 and an openVPN reply is sent through
e1, with a source IP of 1.1.1.5.
So the client receives a packet from 1.1.1.5, but it sent a request to 2.2.2.5, so it displays a warning and ignores the packet.
The same problem I had with SSH also. I know why is this happening and so I found the solution in PF. I used the reply-to statement, and this worked... for SSH. Packets are received on a given interface and sent on the same interface. OpenVPN packets still exit on the wrong interface... I was wondering, is there something that has to do with the tunnels, etc. that makes it fail? I am using the following PF rules (on top of the ruleset):
pass in quick on e1 proto tcp to 1.1.1.5 port ssh reply-to (e1 1.1.1.5)
pass in quick on e1 proto udp to 1.1.1.5 port 1194 reply-to (e1 1.1.1.5)
pass in quick on e2 proto tcp to 2.2.2.5 port ssh reply-to (e2 2.2.2.5)
pass in quick on e2 proto udp to 2.2.2.5 port 1194 reply-to (e2 2.2.2.5)
I have verified that the above rules
should be correct, using tcpdump and observing packets' header info. Odd is the fact that this works flawlessly for SSH, and... it's like
transparent for OpenVPN... could it be because the destination is somehow translated to the openVPN server IP (10.8.0.1 in my case)? I am really not familiar with the internal operation mechanism of OpenVPN. Any thoughts about this are greatly appreciated!
Thank you for your help!
