Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?
 

Hi all!



We have a setup of three computers;
Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0)

hso0 is the packet interface of a 3G modem, it behaves like a normal network interface.

Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a client that receives Network-configuration using DHCP from Machine B automatically.

Machine A eth0 : DHCP
Machine B eth0 : 192.168.2.1
Machine B hso0 : Static IP addr, Internet use
Machine B tun0 : 10.11.0.10 (openVPN client)
Machine C eth0 : Static IP addr, Internet use
Machine C tun0 : 10.11.0.1 (openVPN server)

OpenVPN (server) is configured to allow Internet-traffic to its clients. Code in server.conf:
# Make sure clients traverse tun0 when accessing Internet
push "redirect-gateway def1"
# Push a DNS server (handled by openVPN)
push "dhcp-option DNS 10.11.0.1"

We’re having issues to make Machine C release Internet traffic from Machine A. Note that we have setup masquerading on Machine B using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.
Currently Iptables on Machine B and Machine C have a policy of ACCEPT.

We have managed to make traffic from Machine A reach Machine C, but only with the internal IP of 192.168.2.48 (DHCP).
OpenVPN drops those packets (as it should!) because they come from 192.* and not 10.*

Is there a way to solve this? Thank you!

Internet Traffic through OpenVPN
 

Hi,

1.) when you have the tunnel up between machine b and machine c they ping their tunnel interfaces because they are in the same network 10.11.0.x, right? ok.
2.) to make allow machine a go through the tunnel to machine c, first all, you must create a route to your dhcp network via the tunnel interface of machine b for example:
machine c
ip route add 192.168.2.0/24 via 10.11.0.10
now on machine b you must have to iproute2 to create a table to direct all traffic from origen to go via tunnel to machine c for example:
machine b
1.) create a table called "tunnel" for example in rt_table.
2.) you must set the default to route to your table called tunnel
3.) ip route add default via 10.11.0.1 table tunnel
4.) now, you must say the who need to go throught the tunnel via machine c
5.) ip rule add from machine_a_ip_address table tunnel
6.) now, you should be able to ping from machine a to machine c and vice versa.

I hope this help you.

Anderson

Dear Andy,

thanks for the thorough reply!

"ip route add 192.168.2.0/24 via 10.11.0.10" is already created on Machine B by openVPN.

We have full contact between Machine A, B and C, but the issue is that if Machine A wishes to reach the outside world it fails ; it is traversed with its local IP of 192.168.2.48.

Using TC on Machine B, and Iptables on Machine C, allowed Machine A to be reached from the outside world, but traffic is not full duplex.

For instance:
Machine C has
iptables -t nat -A PREROUTING -d 194.236.x.x -s 217.28.x.x -j DNAT --to-destination 192.168.2.48

Machine B has
tc qdisc add dev eth0 ingress; tc qdisc add dev tun0 ingress;
tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev tun0;


That makes sure that a specific machine on the Internet reaches Machine A.

Routing on Machine B:
machine:~ # route -nv
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.11.0.1 10.11.0.9 255.255.255.255 UGH 0 0 0 tun0
10.11.0.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso1
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso0


Routing on Machine C:
route -nv
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.11.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
194.236.6.128 0.0.0.0 255.255.255.224 U 0 0 0 eth0
192.168.2.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0
10.11.0.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 194.236.6.129 0.0.0.0 UG 0 0 0 eth0



Thank you very much

By the way, the DHCP settings from Machine B are as follows:

IP 192.168.2.2 - .50
Primary Name Server: 10.11.0.1
Secondary Name Server: 193.13.133.1
Default Gateway: 192.168.2.1
Lease Time: 4 hours

Machine A can ping Machine C only if the TC modifications has been made on Machine B.

Ethereal is used on all machines to constantly monitor the traffic to and from the machines, and when the TC mod. is used, only then does Machine B allow traffic from eth0 to go through the tun0 tunnel interface.


Thank you