Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?
Hi all!
We have a setup of three computers; Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0) hso0 is the packet interface of a 3G modem, it behaves like a normal network interface. Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a client that receives Network-configuration using DHCP from Machine B automatically. Machine A eth0 : DHCP Machine B eth0 : 192.168.2.1 Machine B hso0 : Static IP addr, Internet use Machine B tun0 : 10.11.0.10 (openVPN client) Machine C eth0 : Static IP addr, Internet use Machine C tun0 : 10.11.0.1 (openVPN server) OpenVPN (server) is configured to allow Internet-traffic to its clients. Code in server.conf: # Make sure clients traverse tun0 when accessing Internet push "redirect-gateway def1" # Push a DNS server (handled by openVPN) push "dhcp-option DNS 10.11.0.1" We’re having issues to make Machine C release Internet traffic from Machine A. Note that we have setup masquerading on Machine B using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. Currently Iptables on Machine B and Machine C have a policy of ACCEPT. We have managed to make traffic from Machine A reach Machine C, but only with the internal IP of 192.168.2.48 (DHCP). OpenVPN drops those packets (as it should!) because they come from 192.* and not 10.* Is there a way to solve this? Thank you! |
Internet Traffic through OpenVPN
Hi,
1.) when you have the tunnel up between machine b and machine c they ping their tunnel interfaces because they are in the same network 10.11.0.x, right? ok. 2.) to make allow machine a go through the tunnel to machine c, first all, you must create a route to your dhcp network via the tunnel interface of machine b for example: machine c ip route add 192.168.2.0/24 via 10.11.0.10 now on machine b you must have to iproute2 to create a table to direct all traffic from origen to go via tunnel to machine c for example: machine b 1.) create a table called "tunnel" for example in rt_table. 2.) you must set the default to route to your table called tunnel 3.) ip route add default via 10.11.0.1 table tunnel 4.) now, you must say the who need to go throught the tunnel via machine c 5.) ip rule add from machine_a_ip_address table tunnel 6.) now, you should be able to ping from machine a to machine c and vice versa. I hope this help you. Anderson Quote:
|
Dear Andy,
thanks for the thorough reply! "ip route add 192.168.2.0/24 via 10.11.0.10" is already created on Machine B by openVPN. We have full contact between Machine A, B and C, but the issue is that if Machine A wishes to reach the outside world it fails ; it is traversed with its local IP of 192.168.2.48. Using TC on Machine B, and Iptables on Machine C, allowed Machine A to be reached from the outside world, but traffic is not full duplex. For instance: Machine C has iptables -t nat -A PREROUTING -d 194.236.x.x -s 217.28.x.x -j DNAT --to-destination 192.168.2.48 Machine B has tc qdisc add dev eth0 ingress; tc qdisc add dev tun0 ingress; tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev tun0; That makes sure that a specific machine on the Internet reaches Machine A. Routing on Machine B: machine:~ # route -nv Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.11.0.1 10.11.0.9 255.255.255.255 UGH 0 0 0 tun0 10.11.0.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso1 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 hso0 Routing on Machine C: route -nv Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.11.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 194.236.6.128 0.0.0.0 255.255.255.224 U 0 0 0 eth0 192.168.2.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0 10.11.0.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 194.236.6.129 0.0.0.0 UG 0 0 0 eth0 Thank you very much |
By the way, the DHCP settings from Machine B are as follows:
IP 192.168.2.2 - .50 Primary Name Server: 10.11.0.1 Secondary Name Server: 193.13.133.1 Default Gateway: 192.168.2.1 Lease Time: 4 hours Machine A can ping Machine C only if the TC modifications has been made on Machine B. Ethereal is used on all machines to constantly monitor the traffic to and from the machines, and when the TC mod. is used, only then does Machine B allow traffic from eth0 to go through the tun0 tunnel interface. Thank you |
All times are GMT -5. The time now is 12:18 PM. |