I'm setting up a homemade server that will be hosted at a friend's home that have fiber connection (let's call it Home Dedicated Server: HDS), but, I don't want to use his IP connection directly, I want to use a Dedicated Server's connection (let's call it DS) which will protect his own IP, provide a nice DDoS protection, and a better interconnection consistency with the rest of internet.

For that matter, I got a secondary (also called "failover") IP for this given dedicated server. I would like to use this IP as a tunnel for my HDS, so that my HDS can be reached directly through the failover, as if it was its own interface IP, without the need to add a specific port redirection upon any new deployed service.

- Say the secondary IP is
- I'm hosting a service on port 22 on my HDS
- Then any client from the internet could connect to and reach the HDS directly. - On the other hand, the HDS would use the secondary IP as a gateway to reach the internet as well.

Problem is: Even though I'm pretty sure it's harder to explain that to actually do, I have no idea how to achieve exactly that, and what to search around the web, which is why I'm here to get some enlightenment. My guess (and hope) is that some smart routing + a VPN connection could be enough to achieve this.

I made a simple paint schematics if it can help understanding what I'm trying to achieve.

Netwok schematics

Any guidance appreciated.


Well, as usual when i got a tricky question, i'm able to answer it myself after a whole day of work.

For the server/gateway

Let's say my server's default (interface & public IP) is d.d.d.d for the rest of my example.

1) Get a failover IP (additional IP), for this example let's say it's f.f.f.f
2) Once received, add this ip to /etc/network/interfaces

auto eth0:0
iface eth0:0 inet static
address f.f.f.f
broadcast f.f.f.f

Then apply changes with: /etc/init.d/networking restart

3) Setup an openvpn server. There are plenty of tutorials out there... Most are horrible tutorials for the most part. The only advise i can give is to start from the default configs that you can find in help dirs after installing openvpn. So, important parts of the config required to achieve a proper server for our purpose.
For my part, config file is /etc/openvpn/servervpn.conf

# IP and protocols
local d.d.d.d # Listen to your default server IP
port 1194 # Default port, perfectly fine to me
proto udp # Heard there were issues with tcp
dev tap # Can use tun as well
# Certificates and encryption
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
cipher AES-256-CBC
# Tunnel network
server # I'm sticking to default range which is fine
# DNS servers provided by opendns.com.
push "dhcp-option DNS"
push "dhcp-option DNS"
# Keepalive
keepalive 10 120
# Safety
user nobody
group nogroup
# Logging
status openvpn-status.log
log-append /var/log/openvpn.log
verb 5
mute 20

Then restart the service with systemctl restart openvpn@servervpn.service
If config is not perfectly perfect, then no error and no logging are provided, so good luck finding what's wrong.

4) Iptables You need to redirect traffic coming into the failover to the VPN tunnel and relay VPN client's packets to the net as well. That's the part that was the most painful to find... So hope you like it.
Replace f.f.f.f by your failover ip, and is the default VPN network, so change accordingly if not using default one.
Watch out, last IP is my VPN client IP, it might change, but for me it's

iptables -t nat -A POSTROUTING -s ! -d -j SNAT --to-source f.f.f.f
iptables -t nat -A PREROUTING -d f.f.f.f -j DNAT --to-destination

For the VPN Client side (home server)

1) Assign a fixed IP to your home server using MAC assignation, so local home server IP for me is, but that doesn't matter much 2) Redirect port 1194 udp (default port for OpenVPN, but you can use whatever you like) to your local server IP, in my case 3) Install openvpn and connect to your VPN server. Plenty of tutorials for that matter, but important settings again in /etc/openvpn/client.conf for my case:

remote d.d.d.d 1194 # your server main/default IP
dev tap # can use tun as well
proto udp # tcp seems to have issues
remote my-server-1 1194
resolv-retry infinite
user nobody
group nogroup
# Try to preserve some state across restarts.
# Certs
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-256-CBC # Might vary depending on how you set it
# Compression
# Log verbosity
verb 3

Then restart the client: systemctl restart openvpn@client.service

Make sure that your firewall policy is set to accept all (unless you know what you're doing), and you should be ready to go.

Now it should act as if your failover IP is you home server's IP, except your services need to listen to the VPN IP or to

Hope this post will be useful to others.

Figured the required iptables thanks to this french article, so thanks to them: http://www.guiguishow.info/2013/06/14/vpn-unipersonnel-avec-une-ip-failover-en-sortie-sur-un-dedie-ovh/

  • 1
    If you continue using words like "arse", you would no longer be welcome at us. – LinuxSecurityFreak Feb 7 '17 at 16:30
  • Should i use the real word instead? Was kind of a self sensor. – UltimateByte Feb 7 '17 at 21:25
  • @Vlastimil My bad, i thought it wasn't a real word, but in UK, it actually exists. Excuse my french, i'll try to be less emotive next time, will probably help. :o)) Also, after seing your editing, i get that vulgarity isn't welcome here, so i acknowledge it and will do my best to not shock anyone ;) – UltimateByte Feb 8 '17 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.