2

Here is my setup:

Internet - router - Unix router - VPN1 - VPN2 router: 192.168.2.1/24 Unix router: 192.168.2.55/24 VPN1: 10.0.1.0/24 (Unix router: 10.0.1.10) VPN2: 10.0.2.0/24 (Unix router: 10.0.2.10)

Whatever I try, I keep getting some packets being misdirected on one VPN or the other, or even through the direct connection. I tried using connmark without success.

The default outgoing connection from my Unix router needs to be through the direct connection, not the VPNs.

I also would like to be able to get some traffic directed from either VPNs to my Unix router. That's where it gets complicated to control the reverse path correctly.

It doesn't matter if the VPN servers have access to the 192.168.2.0/24 LAN but it would be a nice to have.

Can anyone point me in the right direction using iptables or iproute2?

Here is my current results with OpenVPN's iroute option set:

 # ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp4s0f0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 00:1b:21:4e:3d:8a brd ff:ff:ff:ff:ff:ff 3: enp4s0f1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 00:1b:21:4e:3d:8b brd ff:ff:ff:ff:ff:ff 4: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000 link/ether 00:23:54:27:2b:c5 brd ff:ff:ff:ff:ff:ff inet6 fe80::223:54ff:fe27:2bc5/64 scope link valid_lft forever preferred_lft forever 5: br0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:23:54:27:2b:c5 brd ff:ff:ff:ff:ff:ff inet 192.168.2.55/24 brd 192.168.2.255 scope global br0 valid_lft forever preferred_lft forever inet6 fe80::223:54ff:fe27:2bc5/64 scope link valid_lft forever preferred_lft forever 6: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:7d:a4:f6 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fe7d:a4f6/64 scope link valid_lft forever preferred_lft forever 7: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:41:24:60 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fe41:2460/64 scope link valid_lft forever preferred_lft forever 18: tun2: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100 link/none inet 10.0.2.10 peer 10.0.2.1/32 scope global tun2 valid_lft forever preferred_lft forever 19: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100 link/none inet 10.0.1.10 peer 10.0.1.1/32 scope global tun1 valid_lft forever preferred_lft forever # ip route default via 192.168.2.1 dev br0 metric 5 10.0.1.0/24 via 10.0.1.1 dev tun1 10.0.1.0/24 via 10.0.2.1 dev tun2 10.0.1.1 dev tun1 proto kernel scope link src 10.0.1.10 10.0.2.0/24 via 10.0.1.1 dev tun1 10.0.2.0/24 via 10.0.2.1 dev tun2 10.0.2.1 dev tun2 proto kernel scope link src 10.0.2.10 104.223.87.195 via 192.168.2.1 dev br0 192.168.2.0/24 dev br0 proto kernel scope link src 192.168.2.55 204.44.85.107 via 192.168.2.1 dev br0
Improve this question
4
  • I'm not sure if I understand the setup (the VPNs are not something behind the Unix router), but the "how can I use several internet connections at once" question is a FAQ. With existing IP protocols, you can't. So whatever your setup is, use a single VPN to connect to the Internet, and put the VPN software on some device between the Internet and your internal network, e.g. the Unix router. Commented May 14, 2017 at 7:23
  • And if the VPNs just to connect to two private networks somewhere else, you don't need iptables, just set up the correct route. Commented May 14, 2017 at 7:24
  • @dirkt: There are other machines and VMs involved in the whole setup and I've been able to get it to work at 95% by different means but I can't seem to fully solve it other than using a bridge which I'd like to avoid because of the layer 2 traffic generated. If you know how to set up the route properly, could you please provide more insight into it? Commented May 14, 2017 at 13:32
  • What exactly is not working? Software like OpenVPN should set up the routes automatically. Please edit question with output of ip addr and ip route after starting the VPN tunnels, and describe what exactly you have done with "different means". Commented May 14, 2017 at 17:31

1 Answer 1

Reset to default
0

To start off, my main problem was with net.ipv4.conf.default.rp_filter and net.ipv4.conf.all.rp_filter which need to be set at 2. See /etc/sysctl.conf to change it and use sysctl -p /etc/sysctl.conf to apply the change live.

That said, the full solution to control the return traffic is to first track the connections with connmark:

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -m mark ! --mark 0x0 -j ACCEPT iptables -t mangle -A PREROUTING -i tun1 -j MARK --set-xmark 0x1 iptables -t mangle -A PREROUTING -i tun2 -j MARK --set-xmark 0x2 iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark

Then you need to set up policy based routes. You should define two new routing tables in /etc/iproute2/rt_tables such as:

101 VPN1 102 VPN2

Then do routes for both directions in each table. In my case, the VPN client IPs I get are 10.0.1.10 and 10.0.2.10, and my local network interface is 192.168.2.55. So I do:

ip route add 192.168.2.0/24 via 192.168.2.55 table VPN1 ip route add 192.168.2.0/24 via 192.168.2.55 table VPN2

Then set the rule to follow those tables based on the mark set:

ip rule add fwmark 1 table VPN1 ip rule add fwmark 2 table VPN2

Finally, in my VPN's upscript.sh, I set the default gateway with:

ip route add default via 10.0.1.1 table VPN1

.. for VPN1, and 

ip route add default via 10.0.2.1 table VPN2

.. for VPN2.

If you want the VPN servers to be able to route traffic directly to your LAN, you need to use, with OpenVPN, the iroute instruction for that client on each server (ccd/client) and also add that route entry in its configuration file ('openvpnserver.conf`).

Now start your VPNs and the traffic should always go back where it came in, as it has to.

Note that it would have been possible to reverse masquerade on the VPN servers, but that would hide the source IP which was not acceptable to me at all.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.