I'm having a devil of a time getting accurate information on this setup ... searches result in info all over the map.
Anyway, I have a 13.04 Server (CLI only) which has my Comcast cablemodem connected to eth0 and my home LAN connected to eth1. Currently I have the standard NAT setup to get everything out the door to the Internet:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Now, what I want to add is an OpenVPN connection to a 3rd party provider and tunnel ALL Internet traffic through the OpenVPN tunnel. The thrust of this exercise is to avoid any fiddly stuff that Comcast has been known to do (interception of DNS, web caching, who knows what else). The VPN provider's system automagically builds the proper OpenVPN client.conf file for their service:
remote x.x.x.x 500 udp remote x.x.x.x 123 udp remote x.x.x.x 53 udp key-direction 1 cipher AES-256-CBC client dev tun resolv-retry infinite nobind persist-key persist-tun verb 4 reneg-sec 86400 echo vpn-dc31 ovpn156 tun-mtu 1500 route-method exe route-delay 2 redirect-gateway def1 comp-lzo adaptive explicit-exit-notify 2 fragment 1390 mssfix 1390 hand-window 30 <certificates & keys removed>
I can start the OpenVPN service and the tunnel comes up successfully on tun0:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.4.230 P-t-P:10.8.4.229 Mask:255.255.255.255
but then I notice I have 2 default routes and I can't ping anything on the Internet neither from the Ubuntu server itself, nor the LAN clients:
Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.8.4.229 184.108.40.206 UG 0 0 0 tun0 0.0.0.0 <comcast> 0.0.0.0 UG 0 0 0 eth0 10.8.4.225 10.8.4.229 255.255.255.255 UGH 0 0 0 tun0 10.8.4.229 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 <comcast> 0.0.0.0 255.255.252.0 U 0 0 0 eth0 220.127.116.11 10.8.4.229 18.104.22.168 UG 0 0 0 tun0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 <ovpn provider> <comcast> 255.255.255.255 UGH 0 0 0 eth0
I'm pretty certain there's some iptables work that needs to be done, and that's what I need help with. The provider is no help, if it's not DD-WRT or Tomato, or a simple Linux client, it's "not supported".
Also, I accept Internet connections on certain ports (like SSH, HTTP, etc.) so I can get into the Ubuntu server remotely, and I want those connections to go through the VPN also. The VPN provider gives me a static IP on their side.
Finally, I want this to all work automatically. If the tunnel goes down, it should re-establish. If I reboot the server, it should all come back up automatically.
Thanks for any help or advice!