Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've got some problems with my OpenVPN setup.

The Setup: -> Ubuntu Server 12.04 -> Two active NIC's: eth0 (default): 192.168.1.0/24 eth1: x.x.x.x (external ip)

I've managed to get the routing to work so i can connect to the outside world with the eth1 NIC.

holmen@filserver:~$ ping -I eth1 -c 3 www.linuxquestions.org
PING www.linuxquestions.org (75.126.162.205) from 192.168.1.2 eth1: 56(84) bytes of data.
64 bytes from www.linuxquestions.org (75.126.162.205): icmp_req=1 ttl=50 time=133 ms
64 bytes from www.linuxquestions.org (75.126.162.205): icmp_req=2 ttl=50 time=133 ms
64 bytes from www.linuxquestions.org (75.126.162.205): icmp_req=3 ttl=50 time=133 ms

--- www.linuxquestions.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 133.281/133.336/133.379/0.423 ms
One curious thing is that the "from ip #". It says "from 192.168.1.2 eth1" but that ip is the servers ip on the eth0 iface.

Netstat:

holmen@filserver:~$ netstat -anr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
x.x.x.x     0.0.0.0         255.255.128.0   U         0 0          0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

But here comes the real problem: When setting up openvpn with the option "local x.x.x.x (eth1 ext ip)" it still tunnels the eth0 interface. And i cant understand why.

OpenVPN settings:

client

dev tap

proto udp

local x.x.x.x

remote openvpn.anonine.net 1194
remote openvpn.anonine.net 1195
remote openvpn-2.anonine.net 1196
remote openvpn-2.anonine.net 1197
remote openvpn-3.anonine.net 1198
remote openvpn-3.anonine.net 1199
remote openvpn-4.anonine.net 1200
remote openvpn-4.anonine.net 1201

remote-random

resolv-retry infinite

auth-user-pass

persist-key
persist-tun

ca anonine.ca.crt

ns-cert-type server

comp-lzo

reneg-sec 0

verb 3

Netstat (tunnel active):

holmen@filserver:~$ netstat -anr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         46.246.20.129   128.0.0.0       UG        0 0          0 tap0
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
x.x.x.x         0.0.0.0         255.255.128.0   U         0 0          0 eth1
46.246.20.128   0.0.0.0         255.255.255.128 U         0 0          0 tap0
80.67.8.222     192.168.1.1     255.255.255.255 UGH       0 0          0 eth0
128.0.0.0       46.246.20.129   128.0.0.0       UG        0 0          0 tap0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

Anyone got any ideas?

share|improve this question
add comment

2 Answers

You need to update your iptables with something like this. Where x.x.x.x is your VPN subnet

iptables -t nat -A POSTROUTING -s x.x.x.x/24 -o eth1 -j SNAT --to ip_of_eth1

share|improve this answer
    
This did not do anything to my config. I have been in touch with a community helper at #openvpn and we concluded that it is pretty much impossible do use this setup with tap devices. –  junkyhlm Jan 17 '13 at 9:26
add comment
up vote 0 down vote accepted

I've managed to solve this with two main steps:

  1. Choose a service provider that uses TUN interface.
  2. A little bit more table routing

The Table routing

I've read the most useful howto over at http://lartc.org/howto/ and followed the provided steps there.

My setup is now two physical nic (eth0 and eth1) divided over three tables (main, T1 and T2). T1(eth1) routes the default stuff (apache2, ssh etc.) and T2(eth0) is just for rtorrent connections.

It works like a charm. So if you have the same issue read up over at lartc.org and the problem will be solved.

Note

I have not tried this config with TAP interface so I cannot say if it works or not.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.