Machines involved: A := vpn server inet 10.9.0.1 peer 10.9.0.2 tun0 B := vpn server inet 10.8.0.1 peer 10.9.0.2 tun2 vpn client inet 10.9.0.6 peer 10.9.0.5 tun1 C := vpn client inet 10.8.0.6 peer 10.9.0.5 tun0
There are three machines. Machine B runs both an openvpn server and client. Now I when machine A pushes
redirect-gateway def1 to machine B, then machine C can't connect to the openvpn-server on machine B obviously, because the vpn-server reply packets are routed over to machine A, due to the
0.0.0.0/1 via 10.9.0.5, 18.104.22.168/1 via 10.9.0.5 routes.
Now I need policy routing to route the packets over machine's B WAN gateway.
Failed attempt 1
I tried to mark the packets that are sent from the vpn server with:
iptables -t mangle -A OUTPUT -p tcp -m multiport --sports 1194 -j MARK --set-xmark 14 ip route add table 14 default via WAN_IP ip rule add fwmark 14 table 14
But they are still routed over to machine A, which I could observe with
tcpdump -i tun1 on machine B and
tcpdump -i tun0 on machine A.
**machine B** eth0: 22:22:33.734511 IP machine_C_IP.54089 > machine_B_IP.1194: UDP, length 86 tun1: 22:32:42.713371 IP 10.9.0.6.1194 > machine_C_IP.34514: UDP, length 94 **machine A** tun0: 20:47:47.769628 IP machine_A_IP.openvpn > machine_C_IP.40287: UDP, length 94
Failed attempt 2
I also tried to mark packets by the owner of the openvpn process.
I added to openvpn@.service
Group = vpnserver and then:
iptables -t mangle -A OUTPUT -m owner --gid-owner vpnserver -j MARK --set-xmark 14 ip route add table 14 default via WAN_GATEWAY ip rule add fwmark 14 table 14
But packets are still routed over to machine A.
Following works, but it's something I want to avoid using, because it's not convenient, because I would have to add routes for every client by its IP. Some clients have also dynamic IPs, thus I would have to use a script to retrieve the right IP by a domain name.
ip route add table 14 default via WAN_IP ip rule add to machine_C_IP table 14
Maybe the marked packets fail being routed rightly, because the iptables' OUTPUT chain applies after the actual routing? Or do I miss something while marking the packets? Is there any other way to route the outgoing vpn server packets to my WAN gateway?
default via WAN_GATEWAY dev eth0 table 42 0.0.0.0/1 via 10.9.0.5 dev tun1 default via WAN_GATEWAY dev eth0 onlink 10.1.1.0/24 dev veth0 proto kernel scope link src 10.1.1.2 10.8.0.0/24 via 10.8.0.2 dev tun0 10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1 10.9.0.0/24 via 10.9.0.5 dev tun1 10.9.0.5 dev tun1 proto kernel scope link src 10.9.0.6 WAN_SUBNET/26 via WAN_GATEWAY dev eth0 WAN_SUBNET/26 dev eth0 proto kernel scope link src WAN_IP MACHINE_A_IP via WAN_GATEWAY dev eth0 22.214.171.124/1 via 10.9.0.5 dev tun1
0: from all lookup local 32760: from all fwmark 0xe lookup 42 32761: from all fwmark 0xa lookup 42 32764: from all to WAN_IP lookup 42 32765: from WAN_IP lookup 42 32766: from all lookup main 32767: from all lookup default
ip rule add to machine_C_IP table 14. Didn't find a more clever way yet.
--set-mark), and did you flush the routing caches after adding the routing rules?
iptables -t mangle -A OUTPUT -m owner --gid openvpn -j MARK --mark 42. (2) Use a routing rule like before to use a separate WAN routing table for marked traffic (
ip rule add ...like before). Now you should be able to connect with client on C. (3)
ip rule add iff tun2 table 42.