5

I have a PC with one physical LAN adapter connecting to a VPN server. Is there a way i can setup a (virtual) gateway interface on that same LAN adapter in a way so the other devices on my network can use that as gateway and run their traffic through that and the VPN connection?

Most of my ifconfig:

enp0s21f5 Link encap:Ethernet  HWaddr 4c:cc:6a:d5:94:96  
      inet addr:192.168.1.120  Bcast:192.168.1.255  Mask:255.255.255.0
      inet6 addr: fe80::76e3:9399:187d:fdad/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
lo        Link encap:Local Loopback  
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
      inet addr:10.11.0.2  P-t-P:10.11.0.2  Mask:255.255.0.0
      inet6 addr: fdda:d0d0:cafe:1197::1000/64 Scope:Global
      inet6 addr: fe80::c9b:2e1b:882:1637/64 Scope:Link
      UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
virbr0    Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
      inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
      UP BROADCAST MULTICAST  MTU:1500  Metric:1

And here routing info:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.11.0.1       0.0.0.0         UG    50     0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 enp0s21f5
10.11.0.0       0.0.0.0         255.255.0.0     U     50     0        0 tun0
89.238.176.34   192.168.1.1     255.255.255.255 UGH   100    0        0 enp0s21f5
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 enp0s21f5
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 enp0s21f5
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
  • use route add command on the other client machines to include your pc as gateway. on your pc with vpn you will need to accept connections and redirect the incoming connections to the vpn interface. – kukulo Jun 16 '17 at 16:52
  • Thanks @kukulo, It is those two server steps that i do not really know how or the best way to do. Not sure if i need to use iptables something like: {iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT}? And then rerouting something like: {iptables -t nat -A PREROUTING -s 192.168.1.0 -j DNAT --to 10.11.0.1 iptables -t nat -A POSTROUTING -s 192.168.1.0 -d 10.11.0.1 -j MASQUERADE}? Also i have added my routing table above. – UbuNoob Jun 17 '17 at 20:21
  • How the rest of client will connect to you? To me, it seems you're trying to make your pc as the router, so you need to enable ip forwarding, but your goal is not clear. – fugitive Jun 17 '17 at 20:35
  • You could use something like hostapd, get wifi adapter, and make it as a access point, but still not very reliable solution. – fugitive Jun 17 '17 at 20:41
  • Thanks @fugitive, And yes I do want it to act as a router and pass traffic from other pc's(devices) on the same (V)LAN through its VPN connection. With adding a wifi adapter (or an extra rj45 plug) i am pretty sure i could make it work, as i have come across a few how-to's for that while looking to solve this problem, but i would like to do it without adding extra hardware if it is possible. I managed to get a linksys/dd-wrt router to do it once using only one port, but i do not have it anymore, so would like to get it working on my ubuntu pc now. – UbuNoob Jun 17 '17 at 20:56
4

Solution with wifi adapter and hostapd software:

sudo apt-get install hostapd -y

Configure hostapd

interface=wlan0
ssid=Your_WLAN
hw_mode=g # can be b/g/n
wpa=2
wpa_passphrase=PASS
wpa_key_mgmt=WPA-PSK WPA-EAP WPA-PSK-SHA256 WPA-EAP-SHA256

Edit /etc/network/interfaces

auto wlan0
iface wlan0 inet static
hostapd /etc/hostapd/hostapd.conf
address 192.168.0.1
netmask 255.255.255.0

Because your PC is router you need to enable forwarding to interfaces

  • 1st way echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf && sysctl -p # persistent mode
  • 2nd - echo 1 > /proc/sys/net/ip/ipv4/ip_forward

To enable it on the boot and start it: systemctl enable hostapd && systemctl start hostapd

Install dnsmasq as it will be both your dns and dhcp server.

sudo apt install dnsmasq

edit it's conf file: vi /etc/dnsmasq.conf

interface=lo,wlan0
no-dhcp-interface=lo
dhcp-range=192.168.0.2,192.168.0.254,255.255.255.0,12h

Iptables:

iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE

iptables -A FORWARD -i wlan+ -o tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

Let me know if it works for you.

  • I use something similar on my home, but on raspi which is used as a firewall, and old router that is used for wifi. Routers are more reliable for then wifi adapter – fugitive Jun 17 '17 at 21:26
  • The iptables rules worked like a charm. I didn't need to install dnsmasq though – danidee Apr 20 at 18:39
  • Worked well thanks :) and sorry for the late reply here! – UbuNoob Jun 29 at 19:13
2

fugitive's answer works, even on Ubuntu 19.04 but if you don't need to host an internet connection for your other LAN devices, then you can skip a few steps.

If all devices are connected to your LAN via wifi or wired, you can just use these steps:

  • Confirm that your PC with the VPN connection can forward packets like a router

    1. cat /proc/sys/net/ipv4/ip_forward ##this should return '1', if it doesn't do step 2
    2. echo '1' >> /proc/sys/net/ipv4/ip_forward

or you can use sysctl.conf

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf && sysctl -p #persistent mode

then set iptables to NAT and forward packets received on your local LAN interface and sent out of your tun interface (VPN)

iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE

iptables -A FORWARD -i wlan+ -o tun+ -j ACCEPT #change wlan+ to match your LAN adapter
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

Finally, on your other LAN computer that you want to use your shared VPN - 1. use the route command to add a route for the VPN'd subnets and set the gateway to the IP of your LAN computer network adapter that you set in iptables (not tun, but the wlan+ or en+ adapter)

example: if the computer with the VPN connection has an en0 adapter on your local network with an ip of 192.168.0.100, and your VPN accessible network subnet is 10.0.0.0/24

On your other LAN computer without the VPN connection you'd enter a route cmd like --(for Windows OS)

route add 10.0.0.0 mask 255.0.0.0 192.168.0.100 metric 200 if <interface>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.