3

I'm trying to set up my Pi to act as a VPN client for my corporate network (running OpenVPN).

Right now, I have two Ethernet ports on my Pi -- the builtin one (eth0), and an external USB port (eth1).

Given that I have an internet connection on eth1, would it be possible to set everything up so that any computer connected to eth0 connects directly to the VPN and gets an IP from the OpenVPN server?

If possible, I'd like to be able to add a few "extra" features:

  • A VPN IP for the Pi itself (preferably in a second subnet), so that I can access the Pi itself from my corporate network and send updates/similar to it.
  • A way to have an IP (say 1.1.1.1) routed to the Pi itself so I can SSH and configure the Pi

How could I achieve this setup and have this gateway device?

Improve this question
1
  • 1
    OpenVPN commonly uses a tun (for "tunnel") virtual interface for this purpose; this works over an existing real interface but will have a second IP (i.e., you do not need to dedicate an eth port completely to it). However, the server must support this mode, so that is something you could check on. OpenVPN is widely used on linux and if you search for that ("openvpn linux", instead of, e.g., "openvpn raspbian" or "openvpn raspberry pi") you should find lots of information. Commented Sep 3, 2016 at 2:01

1 Answer 1

Reset to default
1

You can do something like this if you add a few things to your config:

  1. Create a script to run on tun/tap connect as described here. Let's say this calls /usr/local/bin/vpn-up on connect and .../vpn-down on disconnect.
  2. Up will need to turn on routing and set up an IP Masquerade for anything outbound over tap0. See below.
  3. Down will just run the -F line from up to flush the table entry. See below.
  4. I imagine you'll want a DHCP server on eth0 so computers plugged into it will get their ip automatically...

The scripts:

-- vpn-up -- sysctl -w net.ipv4.ip_forward=1 iptables -t nat -F POSTROUTING iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE -- vpn-down -- iptables -t nat -F POSTROUTING

Vpn-up will coerce packets going out tap0 to all appear to come from the VPN client IP. I don't think OpenVPN messes with the POSTROUTING table; if it does, this might be trickier. Vpn-down just flushes the rules.

There are also about a bazillion ways to configure OpenVPN, so YMMV depending on your setup.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.