0

I have a home network with a DSL router. One machine on the network opens a openvpn connection to a third party vpn provider. This machine then acts as a router for all machines on my network that have their gateway set to this machine, providing them with internet acces over the vpn. Some machines have to DSL router set as gateway and access the internet without vpn.

I would like to come in from the DSL router to access my home network when I am away. For this, I created a second openvpn connection on the machine providing the vpn that listens on port 1194 and forwarded that port on my DSL router. However, I can only access the port when the first vpn is down.

I suspect there is some simple routing mistake that I don't understand.

Some basic information:

# 192.168.178.1 is my DSL router.
# 192.168.178.8 is the machine that opens the tun0 vpn connection and routes all traffic through tun0.
# xx.xxx.xxx.xxx is the ip of my third party vpn provider.
# (not relevant but shows up below) Port 33075 is open from the vpn side and is forwarded to a specific machine on the network.
# tun1 was created on 192.168.178.8 with port 1194 for access from outside.
# Port 1194 is opened on the DSL router (192.168.178.1) and forwarded to 192.168.178.8

With tun0 and tun1 down:

% route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.178.1   0.0.0.0         UG    0      0        0 eno1
192.168.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eno1

% ip route
default via 192.168.178.1 dev eno1 proto static
192.168.0.0/16 dev eno1 proto kernel scope link src 192.168.178.8

% sudo iptables-save
(empty output)

With only tun1 up: Forwarded port 1194 from the non-vpn outside shows open

% route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.178.1   0.0.0.0         UG    0      0        0 eno1
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun1
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun1
192.168.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eno1

% ip route
default via 192.168.178.1 dev eno1 proto static
10.8.0.0/24 via 10.8.0.2 dev tun1
10.8.0.2 dev tun1 proto kernel scope link src 10.8.0.1
192.168.0.0/16 dev eno1 proto kernel scope link src 192.168.178.8

% sudo iptables-save
(empty output)

With both tun0 and tun1 up: Forwarded port 1194 from the non-vpn outside shows closed

% route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.28.78.1      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.178.1   0.0.0.0         UG    0      0        0 eno1
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun1
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.28.78.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
xx.xxx.xxx.xxx  192.168.178.1   255.255.255.255 UGH   0      0        0 eno1
128.0.0.0       10.28.78.1      128.0.0.0       UG    0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eno1

% 0.0.0.0/1 via 10.28.78.1 dev tun0
default via 192.168.178.1 dev eno1 proto static
10.8.0.0/24 via 10.8.0.2 dev tun1
10.8.0.2 dev tun1 proto kernel scope link src 10.8.0.1
10.28.78.0/24 dev tun0 proto kernel scope link src 10.28.78.159
xx.xxx.xxx.xxx via 192.168.178.1 dev eno1
128.0.0.0/1 via 10.28.78.1 dev tun0
192.168.0.0/16 dev eno1 proto kernel scope link src 192.168.178.8

%  sudo iptables-save
# Generated by iptables-save v1.8.10 (nf_tables) on 
*filter
:INPUT ACCEPT [44:5124]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i eno1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -d 192.168.178.138/32 -p tcp -m tcp --dport 33075 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.178.138/32 -p udp -m udp --dport 33075 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on 
# Generated by iptables-save v1.8.10 (nf_tables) on 
*nat
:PREROUTING ACCEPT [76:7067]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i tun0 -p tcp -m tcp --dport 33075 -j DNAT --to-destination 192.168.178.138:33075
-A PREROUTING -i tun0 -p udp -m udp --dport 33075 -j DNAT --to-destination 192.168.178.138:33075
-A POSTROUTING -o eno1 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
# Completed on
Improve this question

1 Answer 1

Reset to default
0

Because your tun0 vpn adds default route "overrides" (i.e., the /1 routes, which ARE what you want apparently), (encapsulated) traffics sent by the tun1 vpn server (to clients in a "remote network") will be routed into the tun0 tunnel (instead of your router), and would therefore be NAT'd with a public IP different from the one the client used to connect to the server, which the client would not recognize.

You would need policy routing for this:

ip route add default via 192.168.178.1 dev eno1 onlink table 123
ip rule add iif lo sport 1194 lookup 123

(You may add ipproto udp or ipproto tcp to the rule depending on the protocol used by the tun1 vpn.)

Also make sure the rp_filter sysctl of eno1 is not 1 (but 0 or 2).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .