0

I am running ubuntu server 16.04 and openvpn. I would like to change my settings on the vpnserver so that all the traffic comes in on the current connection (192.168.1.254) and all my traffic goes out my second internet connection (192.168.2.3).

My current routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 ens33
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 ens33
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 ens34

Currently I can access the vpn on ens33 but that will use ens33 as default gateway (192.168.1.254). If i add metric to the interfaces so ens34 metric 10 and ens33 metric 100 I cannot reach the server. If I change /etc/ufw/before.rules

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# I CHANGED THIS FROM DEFAULT ens33 to ens34   
-A POSTROUTING -s 10.8.0.0/8 -o ens34 -j MASQUERADE
COMMIT
# END OPENVPN RULE

I can access the server to connect but not the internet in browser...

My interface setup is as follows:

    # This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#auto ens33
#iface ens33 inet dhcp
# The primary network interface
auto ens33
iface ens33 inet static
address 192.168.1.72
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.254
#metric 10

# the secondary network interface
auto ens34
iface ens34 inet  static
address 192.168.2.12
netmask 255.255.255.0
broadcast 192.168.2.255
gateway 192.168.2.3
dns-nameservers 8.8.4.4 8.8.8.8
#metric 100

I am missing a route rule or something but I have been banging my head against the wall this last few days on this one... Can someone please help me? I'm any help is appreciated!! Thanks in advance!! <3<3<3

1 Answer 1

0

To me it is not really clear what you try to achieve. Let me assume you have two ethernet interfaces: eth0 and eth1. Eth0 is connected to the internet, while eth1 is connected to your home-lan-network. In this case, you could use your server as router, that gives internet access at eth0 to all devices connected to eth1.

For this to work, you would need a dhcp server that assigns IP's to the devices connected to your eht1 interface. Also you would need to forward the traffic between the two eth devices.

Dhcp server installation and configuration:

sudo apt-get install dnsmasq

sudo nano /etc/dnsmasq.conf

interface=eth1 # The interface for the dhcp server to listen to
dhcp-range=192.168.179.10,192.168.179.150,255.255.255.0,12h # Dhcp server IP adress + Range + Netmask + Leasetime

Routing and forwarding

sudo nano /etc/sysctl.conf

uncomment the line

net.ipv4.ip_forward=1

and let the changes take effect:

sudo sysctl -p

Modify IP tables. I recommend you to write a script for this purpose, so you can do changes quick, in case you need to experiment. The script will delete all iptables rules, set chain rules to ACCEPT and than append the routing rules:

nano firewall-script.sh
#!/bin/bash
IPTABLES="/sbin/iptables"

# ACCEPT everything by default.

$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

# Set the nat/mangle/raw tables' chains to ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT

$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT

# Cleanup - Delete all iptables-rules.
#------------------------------------------------------------------------------

# Delete all
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# Delete all
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

# Zero all packets and counters.
$IPTABLES -Z
$IPTABLES -t nat -Z
$IPTABLES -t mangle -Z

#------------------------------------------------------------------------------    

$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$IPTABLES -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i eth1 -o eth0 -j ACCEPT

Save the file CTRL+X and make it executable chmod +x firewall-script.sh.

when you want to save your iptables-rules - otherwise they will be lost after reboot - install sudo apt-get install iptables-persistent. In case you already installed it type sudo dpkg-reconfigure iptables-persistent. I recommend you not to save the rules made by my script, because it opens everything. My IPTABLES script is only for testing purpose.

Now you should be able to use your server as router. Next step would be to modify the script to use the vpn-connection of the server.

Start your VPN connection. When the connection is established type ifconfig. You should see a tun-device. I suppose your vpn-connection is using tun0 and eth1 is connected to your lan-homenetwork:

$IPTABLES -t nat -A POSTROUTING -o tun0 -j MASQUERADE
$IPTABLES -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i eth1 -o tun0 -j ACCEPT

Now all home-traffic should be routet thru your vpn. I hope this helps you somehow.

2
  • I want to access the vpn server on internetconnection#1(ens33[GW192.168.1.254]) but i want the open vpn server to then route all the vpn traffic out internetconnection#2(ens34[GW192.168.2.3]) I can currently connect to the vpn but i cannot get traffic going over the second gateway. If i listen to the second device sudo tcpdump -ni ens34 udp and port 1101 (ens34) when connected to vpn server and trying to access web i see some packets but they appear to be getting blocked.
    – user783233
    Jan 16, 2018 at 16:20
  • U should try to modify the iptables command i did post you. To me it sounds like if u want to make your vpn accessable to all devices behind interface ens34. Thats what i did explain to you in my awnser. You only have to mod tun0, eth1, eth0 to your needs. What is confusing me here is that you say "internetconnection#1" and "internetconnection#2" Jan 16, 2018 at 18:33

You must log in to answer this question.