Well, as usual when i got a tricky question, i'm able to answer it myself after a whole day of work.
For the server/gateway
Let's say my server's default (interface & public IP) is d.d.d.d for the rest of my example.
1) Get a failover IP (additional IP), for this example let's say it's
2) Once received, add this ip to
iface eth0:0 inet static
Then apply changes with:
3) Setup an openvpn server. There are plenty of tutorials out there... Most are horrible tutorials for the most part. The only advise i can give is to start from the default configs that you can find in help dirs after installing openvpn.
So, important parts of the config required to achieve a proper server for our purpose.
For my part, config file is
# IP and protocols
local d.d.d.d # Listen to your default server IP
port 1194 # Default port, perfectly fine to me
proto udp # Heard there were issues with tcp
dev tap # Can use tun as well
# Certificates and encryption
tls-auth ta.key 0
# Tunnel network
server 10.8.0.0 255.255.255.0 # I'm sticking to default range which is fine
# DNS servers provided by opendns.com.
push "dhcp-option DNS 126.96.36.199"
push "dhcp-option DNS 188.8.131.52"
keepalive 10 120
Then restart the service with
systemctl restart email@example.com
If config is not perfectly perfect, then no error and no logging are provided, so good luck finding what's wrong.
You need to redirect traffic coming into the failover to the VPN tunnel and relay VPN client's packets to the net as well. That's the part that was the most painful to find... So hope you like it.
Replace f.f.f.f by your failover ip, and 10.8.0.0/24 is the default VPN network, so change accordingly if not using default one.
Watch out, last IP is my VPN client IP, it might change, but for me it's 10.8.0.4
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source f.f.f.f
iptables -t nat -A PREROUTING -d f.f.f.f -j DNAT --to-destination 10.8.0.4
For the VPN Client side (home server)
1) Assign a fixed IP to your home server using MAC assignation, so local home server IP for me is 192.168.1.2, but that doesn't matter much
2) Redirect port 1194 udp (default port for OpenVPN, but you can use whatever you like) to your local server IP, in my case 192.168.1.2
3) Install openvpn and connect to your VPN server. Plenty of tutorials for that matter, but important settings again in
/etc/openvpn/client.conf for my case:
remote d.d.d.d 1194 # your server main/default IP
dev tap # can use tun as well
proto udp # tcp seems to have issues
remote my-server-1 1194
# Try to preserve some state across restarts.
tls-auth ta.key 1
cipher AES-256-CBC # Might vary depending on how you set it
# Log verbosity
Then restart the client: systemctl restart firstname.lastname@example.org
Make sure that your firewall policy is set to accept all (unless you know what you're doing), and you should be ready to go.
Now it should act as if your failover IP is you home server's IP, except your services need to listen to the VPN IP or to 0.0.0.0.
Hope this post will be useful to others.
Figured the required iptables thanks to this french article, so thanks to them: http://www.guiguishow.info/2013/06/14/vpn-unipersonnel-avec-une-ip-failover-en-sortie-sur-un-dedie-ovh/