2

I seek to tunnel one SSL VPN (F5, running on my debian laptop==client) through another (OpenVPN, running on a debian linode==server), but lose all client networking (including, e.g., ping) after the F5VPN connects. I'm not sure whether this is due to my OpenVPN configuration or my server's firewall/iptables, but suspect the latter. Unfortunately I am not knowledgeable regarding networking, so I'd appreciate any assistance you could provide.

I need to remotely (off the physical LAN) SSH into some firewalled compute clusters to do environmental modeling (e.g., this). Formerly I could do this from my debian laptop using the cluster-provider-mandated F5VPN, the client for which is known as the F5NAP (for "network access [browser] plugin." However, access policy changed (notably to require a single registered IP#), so I can no longer do this "directly" (i.e., just running the F5VPN from my laptop). I seek to adapt to the new policy (and resume work on my project) by implementing a VPN tunnel from my client/laptop through a debian linode server/jumpbox. Design details here, but my design can be roughly summarized with the following ASCII art:

                     <-MY CONTROL | AGENCY CONTROL->
                                  |                    firewall
+----------+      +-----------+   |   +---------------+   ||   +---------+
| laptop + |      | linode  + |   |   | remote-access |   ||   | cluster |
| F5NAP  + | <--> | OpenVPN   | <-|-> | website +     | <-||-> | node(s) |
| OpenVPN  |      | server  + |   |   | F5VPN server  |   ||   |         |
| client   |      | security  |   |   |               |   ||   |         |
+----------+      +-----------+   |   +---------------+   ||   +---------+

(Implementation details here. Note that F5NAP==F5VPN client.) The good news is, the following sequence works: I can

  1. start an OpenVPN server on my linode (aka "the server")
  2. start an OpenVPN client on my laptop, after which whatismyip.com shows the IP# of the server (which is registered)
  3. start the F5VPN client (an F5NAP'ed Firefox), and from that still see the server's IP#.
  4. using the F5VPN client, login to the agency's remote-access website, and bring up the F5VPN's control UI (e.g., to start/stop/logout).

The bad news (details here) is, as soon as I start the F5VPN, and see status==Connected in its web UI, my client/laptop loses IP networking. I had originally thought this was just a DNS problem, but I cannot even ping IP#s, e.g.,

me@client:~ $ ping -c 4 141.101.120.15 # == www.whatismyip.com
PING 141.101.120.15 (141.101.120.15) 56(84) bytes of data.

--- 141.101.120.15 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3022ms

(The only consolation here is that the network failure kills the tunnel, which causes my client to regain its networking ... but also its access to the registered IP#.)

I had thought that this problem was due to OpenVPN misconfiguration on my part, but now suspect that I need to tweak my server firewall (which is iptables, running on Debian 7.8) in order to allow my OpenVPN configuration to work: see a client-commandline debugging session here.

One more complication: the F5VPN is proprietary and not (IMHO) particularly well supported by either F5 (the vendor) or the cluster provider (their customer, aka "the agency"). Particularly, I don't know (but have asked) for the IP#(s) of the agency's VPN server: I only know the name (for which DNS tells me the IP# :-) of the remote-access website that I need to use to login to the F5VPN.

  • Bravo! +1 for the recursive nature of the task you want to do! I have no experience with SSH tunneling, but I applaud your sense of style! – Bruce Ediger Jan 21 '15 at 18:43
  • believe me, I wouldn't be trying to do this if they hadn't made me :-( I was quite happy directly shelling into the clusters ... – TomRoche Jan 21 '15 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.