HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   Technical (http://www.howtoforge.com/forums/forumdisplay.php?f=8)
-   -   OpenVPN traffic routing on secondary IP problem (http://www.howtoforge.com/forums/showthread.php?t=37223)

dominos 6th July 2009 08:04

OpenVPN traffic routing on secondary IP problem
 
Hi.

I am not sure where to post this but I feel this is the appropriate section. [Mods, please move the thread to the right section if you feel otherwise.]

I seem to have a problem running a second instance of OpenVPN using a secondary IP address on my virtual machine (VPS) to successfully route my internet traffic through it. The first instance works well, with the OpenVPN server managed to create a tun1 adapter and route clients' traffic to the primary ethernet adapter and IP address on the machine, which is eth0 (aaa.aaa.aaa.aaa). All is well with the first one.

However, the same could not be done with the secondary IP/ethernet adapter, which its adapter name is eth0:0 (bbb.bbb.bbb.bbb) and a tun0 adapter. OpenVPN managed to bind to the said IP and I was able to connect to it and ping the internal VPN IP network (10.11.0.0/24), including the gateway (10.11.0.1) and my assigned IP (10.11.0.6), but for some wierd reasons, I could not browse the internet through it, as if the iptables was not set up correctly. It could be, given that when I try to set up the rules for the second server, I got a warning message about the ethernet adapter having a 'wierd character' in it. Although it shoots out a warning, the rule does seem to be applied when I invoke a list command ("iptables -t nat -L").

Code:

$ iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -o eth0:0 -j MASQUERADE
Warning: weird character in interface `eth0:0' (No aliases, :, ! or *).

I even tried replacing the "-o eth0:0" switch to use IP address instead ("-d [IP]") but to no avail as well.

Any ideas on why it does work on the first OpenVPN server but not the second one? My machine is a Xen-based VPS, running Debian 64-bit. Replies are very much appreciated.

Here are my configuration files for your reference:

---
first-openvpn-server.conf
---
Code:

local aaa.aaa.aaa.aaa
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp-aaa.txt
push "redirect-gateway"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-aaa.log
verb 3

---

---
first-openvpn-server-client-config.ovpn
---
Code:

client
dev tun
proto udp
remote aaa.aaa.aaa.aaa 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert aaa.crt
key aaa.key
remote-cert-tls server

---

---
second-openvpn-server.conf
---
Code:

local bbb.bbb.bbb.bbb
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.11.0.0 255.255.255.0
ifconfig-pool-persist ipp-bbb.txt
push "redirect-gateway"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-bbb.log
verb 3

---

---
second-openvpn-server-client-config.ovpn
---
Code:

client
dev tun
proto udp
remote bbb.bbb.bbb.bbb 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert aaa.crt
key aaa.key
remote-cert-tls server

---

IPTables rules:

Code:

$ iptables -P FORWARD ACCEPT
$ iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
$ iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -o eth0:0 -j MASQUERADE

* net.ipv4.ip_forward=1 is uncommented in /etc/sysctl.conf


All times are GMT +2. The time now is 22:54.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.