Home / server / Questions / 495609
Accepted
gparent
Asked: 2013-04-03 20:08:46 +0800 CST

OpenVPN Endpoint to endpoint using the real IPs

  • 772

I want to connect two servers to eachother over the internet. For various reasons I cannot use IPSec for this.

I would like traffic to be transparently encrypted as if I was using IPSec transport mode. I have decided to use routing for this (but I'm open to better alternatives)

My tunnel is up on 10.255.255.0/30, A uses .1, B uses .2. Let's say server A is at 192.168.0.100 and server B 172.16.0.200.

While I could add a route to encrypt all traffic (using on A ip route add 172.16.0.200/32 dev tun0 via 10.255.255.2), doing so kills the tunnel because OpenVPN traffic is using the same remote IP to keep the tunnel up.

I need a way to route the actual OpenVPN tunnel through eth0 but otherwise use tun0 to carry all traffic between server A and B. I have ip_forward enabled on both servers and appropriate firewall rules to allow the traffic, but I am not sure where to start in iptables to accomplish this.

vpn

2 Answers

  1. Best Answer

    I guess what you need is an additional routing table for all traffic between 2 hosts except openvpn. You may try something like this:

    iptables -t mangle -A OUTPUT -d 172.16.0.200/32 -p <vpn_protocol> ! --dport <vpn_port> -j MARK --set-mark 2

    ip route add default via 10.255.255.2 dev tun0 table 2

    ip rule add fwmark 2 table 2

    on either side of your tunnel

    • 3

  2. You should add a route to the remote network through the tunneling interface and a more specific route ensuring that your traffic to the remote OpenVPN gateway is not sent via the tunnel interface. Example:

    ip route add 192.168.0.0/24 via 10.255.255.2 dev tun0
ip route add 192.168.0.100 via 172.16.0.1 dev eth0

    The first ip route is adding a route to the destination network while the second ip route is adding a host route to the OpenVPN gateway located in the same network. 172.16.0.1 is the gateway with a valid route to 192.168.0.100 and eth0 is the local interface connecting to the same network as the gateway. Note that the first ip route would be unnecessary if you have configured OpenVPN with route and push "route ..." statements as it would be added by the OpenVPN daemon upon startup / successful connection setup.

    • 1