Networking Tunnel a home server through a dedicated failover IP

Question

I'm setting up a homemade server that will be hosted at a friend's home that have fiber connection (let's call it Home Dedicated Server: HDS), but, I don't want to use his IP connection directly, I want to use a Dedicated Server's connection (let's call it DS) which will protect his own IP, provide a nice DDoS protection, and a better interconnection consistency with the rest of internet.

For that matter, I got a secondary (also called "failover") IP for this given dedicated server. I would like to use this IP as a tunnel for my HDS, so that my HDS can be reached directly through the failover, as if it was its own interface IP, without the need to add a specific port redirection upon any new deployed service.

Example:
- Say the secondary IP is 127.1.2.3
- I'm hosting a service on port 22 on my HDS
- Then any client from the internet could connect to 127.1.2.3:22 and reach the HDS directly. - On the other hand, the HDS would use the secondary IP as a gateway to reach the internet as well.

Problem is: Even though I'm pretty sure it's harder to explain that to actually do, I have no idea how to achieve exactly that, and what to search around the web, which is why I'm here to get some enlightenment. My guess (and hope) is that some smart routing + a VPN connection could be enough to achieve this.

I made a simple paint schematics if it can help understanding what I'm trying to achieve.

Any guidance appreciated.

Answer 1

Well, as usual when i got a tricky question, i'm able to answer it myself after a whole day of work.

For the server/gateway

Let's say my server's default (interface & public IP) is d.d.d.d for the rest of my example.

1) Get a failover IP (additional IP), for this example let's say it's f.f.f.f
2) Once received, add this ip to /etc/network/interfaces

auto eth0:0
iface eth0:0 inet static
address f.f.f.f
netmask 255.255.255.255
broadcast f.f.f.f

Then apply changes with: /etc/init.d/networking restart

3) Setup an openvpn server. There are plenty of tutorials out there... Most are horrible tutorials for the most part. The only advise i can give is to start from the default configs that you can find in help dirs after installing openvpn. So, important parts of the config required to achieve a proper server for our purpose.
For my part, config file is /etc/openvpn/servervpn.conf

# IP and protocols
local d.d.d.d # Listen to your default server IP
port 1194 # Default port, perfectly fine to me
proto udp # Heard there were issues with tcp
dev tap # Can use tun as well
# Certificates and encryption
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
cipher AES-256-CBC
# Tunnel network
server 10.8.0.0 255.255.255.0 # I'm sticking to default range which is fine
comp-lzo
# DNS servers provided by opendns.com.
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# Keepalive
keepalive 10 120
# Safety
user nobody
group nogroup
persist-key
persist-tun
# Logging
status openvpn-status.log
log-append /var/log/openvpn.log
verb 5
mute 20

Then restart the service with systemctl restart openvpn@servervpn.service
If config is not perfectly perfect, then no error and no logging are provided, so good luck finding what's wrong.

4) Iptables You need to redirect traffic coming into the failover to the VPN tunnel and relay VPN client's packets to the net as well. That's the part that was the most painful to find... So hope you like it.
Replace f.f.f.f by your failover ip, and 10.8.0.0/24 is the default VPN network, so change accordingly if not using default one.
Watch out, last IP is my VPN client IP, it might change, but for me it's 10.8.0.4

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source f.f.f.f
iptables -t nat -A PREROUTING -d f.f.f.f -j DNAT --to-destination 10.8.0.4

For the VPN Client side (home server)

1) Assign a fixed IP to your home server using MAC assignation, so local home server IP for me is 192.168.1.2, but that doesn't matter much 2) Redirect port 1194 udp (default port for OpenVPN, but you can use whatever you like) to your local server IP, in my case 192.168.1.2 3) Install openvpn and connect to your VPN server. Plenty of tutorials for that matter, but important settings again in /etc/openvpn/client.conf for my case:

client
remote d.d.d.d 1194 # your server main/default IP
dev tap # can use tun as well
proto udp # tcp seems to have issues
remote my-server-1 1194
resolv-retry infinite
user nobody
group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# Certs
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-256-CBC # Might vary depending on how you set it
# Compression
comp-lzo
# Log verbosity
verb 3

Then restart the client: systemctl restart openvpn@client.service

Make sure that your firewall policy is set to accept all (unless you know what you're doing), and you should be ready to go.

Now it should act as if your failover IP is you home server's IP, except your services need to listen to the VPN IP or to 0.0.0.0.

Hope this post will be useful to others.

Figured the required iptables thanks to this french article, so thanks to them: http://www.guiguishow.info/2013/06/14/vpn-unipersonnel-avec-une-ip-failover-en-sortie-sur-un-dedie-ovh/