LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-23-2008, 08:34 AM   #1
theVOID
LQ Newbie
 
Registered: Feb 2008
Posts: 6

Rep: Reputation: 0
Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?


Hi all!



We have a setup of three computers;
Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0)

hso0 is the packet interface of a 3G modem, it behaves like a normal network interface.

Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a client that receives Network-configuration using DHCP from Machine B automatically.

Machine A eth0 : DHCP
Machine B eth0 : 192.168.2.1
Machine B hso0 : Static IP addr, Internet use
Machine B tun0 : 10.11.0.10 (openVPN client)
Machine C eth0 : Static IP addr, Internet use
Machine C tun0 : 10.11.0.1 (openVPN server)

OpenVPN (server) is configured to allow Internet-traffic to its clients. Code in server.conf:
# Make sure clients traverse tun0 when accessing Internet
push "redirect-gateway def1"
# Push a DNS server (handled by openVPN)
push "dhcp-option DNS 10.11.0.1"

We’re having issues to make Machine C release Internet traffic from Machine A. Note that we have setup masquerading on Machine B using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.
Currently Iptables on Machine B and Machine C have a policy of ACCEPT.

We have managed to make traffic from Machine A reach Machine C, but only with the internal IP of 192.168.2.48 (DHCP).
OpenVPN drops those packets (as it should!) because they come from 192.* and not 10.*

Is there a way to solve this? Thank you!
 
Old 04-24-2008, 07:35 AM   #2
andybrr
Member
 
Registered: Mar 2006
Posts: 54

Rep: Reputation: 15
Internet Traffic through OpenVPN

Hi,

1.) when you have the tunnel up between machine b and machine c they ping their tunnel interfaces because they are in the same network 10.11.0.x, right? ok.
2.) to make allow machine a go through the tunnel to machine c, first all, you must create a route to your dhcp network via the tunnel interface of machine b for example:
machine c
ip route add 192.168.2.0/24 via 10.11.0.10
now on machine b you must have to iproute2 to create a table to direct all traffic from origen to go via tunnel to machine c for example:
machine b
1.) create a table called "tunnel" for example in rt_table.
2.) you must set the default to route to your table called tunnel
3.) ip route add default via 10.11.0.1 table tunnel
4.) now, you must say the who need to go throught the tunnel via machine c
5.) ip rule add from machine_a_ip_address table tunnel
6.) now, you should be able to ping from machine a to machine c and vice versa.

I hope this help you.

Anderson

Quote:
Originally Posted by theVOID View Post
Hi all!



We have a setup of three computers;
Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0)

hso0 is the packet interface of a 3G modem, it behaves like a normal network interface.

Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a client that receives Network-configuration using DHCP from Machine B automatically.

Machine A eth0 : DHCP
Machine B eth0 : 192.168.2.1
Machine B hso0 : Static IP addr, Internet use
Machine B tun0 : 10.11.0.10 (openVPN client)
Machine C eth0 : Static IP addr, Internet use
Machine C tun0 : 10.11.0.1 (openVPN server)

OpenVPN (server) is configured to allow Internet-traffic to its clients. Code in server.conf:
# Make sure clients traverse tun0 when accessing Internet
push "redirect-gateway def1"
# Push a DNS server (handled by openVPN)
push "dhcp-option DNS 10.11.0.1"

We’re having issues to make Machine C release Internet traffic from Machine A. Note that we have setup masquerading on Machine B using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.
Currently Iptables on Machine B and Machine C have a policy of ACCEPT.

We have managed to make traffic from Machine A reach Machine C, but only with the internal IP of 192.168.2.48 (DHCP).
OpenVPN drops those packets (as it should!) because they come from 192.* and not 10.*

Is there a way to solve this? Thank you!
 
Old 04-25-2008, 03:05 AM   #3
rszabo
LQ Newbie
 
Registered: Apr 2008
Posts: 2

Rep: Reputation: 0
Dear Andy,

thanks for the thorough reply!

"ip route add 192.168.2.0/24 via 10.11.0.10" is already created on Machine B by openVPN.

We have full contact between Machine A, B and C, but the issue is that if Machine A wishes to reach the outside world it fails ; it is traversed with its local IP of 192.168.2.48.

Using TC on Machine B, and Iptables on Machine C, allowed Machine A to be reached from the outside world, but traffic is not full duplex.

For instance:
Machine C has
iptables -t nat -A PREROUTING -d 194.236.x.x -s 217.28.x.x -j DNAT --to-destination 192.168.2.48

Machine B has
tc qdisc add dev eth0 ingress; tc qdisc add dev tun0 ingress;
tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev tun0;


That makes sure that a specific machine on the Internet reaches Machine A.

Routing on Machine B:
machine:~ # route -nv
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.11.0.1 10.11.0.9 255.255.255.255 UGH 0 0 0 tun0
10.11.0.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso1
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso0


Routing on Machine C:
route -nv
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.11.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
194.236.6.128 0.0.0.0 255.255.255.224 U 0 0 0 eth0
192.168.2.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0
10.11.0.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 194.236.6.129 0.0.0.0 UG 0 0 0 eth0



Thank you very much
 
Old 04-25-2008, 03:34 AM   #4
rszabo
LQ Newbie
 
Registered: Apr 2008
Posts: 2

Rep: Reputation: 0
By the way, the DHCP settings from Machine B are as follows:

IP 192.168.2.2 - .50
Primary Name Server: 10.11.0.1
Secondary Name Server: 193.13.133.1
Default Gateway: 192.168.2.1
Lease Time: 4 hours

Machine A can ping Machine C only if the TC modifications has been made on Machine B.

Ethereal is used on all machines to constantly monitor the traffic to and from the machines, and when the TC mod. is used, only then does Machine B allow traffic from eth0 to go through the tun0 tunnel interface.


Thank you

Last edited by rszabo; 04-25-2008 at 03:35 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how can I audit traffic through openvpn jlarsen Linux - Software 3 03-26-2008 05:28 PM
See subnets with OpenVpn/IpTables Niels@debian Linux - Networking 0 01-26-2008 10:56 AM
Will IPTables w/ NAT conflict w/ OpenVPN? licht Linux - Security 1 07-19-2007 08:22 PM
OpenVPN route issues, all traffic through VPN tunnel stuartornum Linux - Server 4 03-05-2007 03:07 AM
IPTables is blocking my OpenVPN internet access! eponymous Linux - Security 2 01-23-2007 01:40 PM


All times are GMT -5. The time now is 12:30 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration