I have VPN network based on OpenVPN software. I need route all network traffic in VPN network where destination IP is from specific country via one specific client on this VPN network (VPN client IP address) - Mikrotik router where is configured NAT (MASQUERADE) for main internet interface (PPPoE). I need get public, dynamic IP address owned by this VPN client (Mikrotik router - PPPoE interface) for all this traffic. So on VPN server I created iptables mangle rule and I use geoip iptables module:

iptables -A PREROUTING -t mangle -i tun0 -m geoip --destination-country COUNTRY_CODE -j MARK --set-mark 1

So I have marked all traffic from client which have destination IP from this specific country. Next I have tried use this solution: Create specific route table and add default route. But default route can be only for next hop on this network. So when I use this command:

ip route add default via specific_VPN_client dev tun0 table CountryRoute 

I get this error:

RTNETLINK answers: Network is unreachable

Is possible route specific traffic to specific client, but not to next hop please?

I tried this iptables rule too:

iptables -A PREROUTING -i tun0 -m geoip --destination-country COUNTRY_CODE -j DNAT --to-destination Mikrotik_VPN_IP

But traffic ends on Mikrotik router. Maybe would be possible solve this problem on this router?

OpenVPN server (10.1.1.1) route table:

default via PUBLIC_IP_VPN_SERVER dev eth0
10.1.1.0/24 via 10.1.1.2 dev tun0
10.1.1.2 dev tun0  proto kernel  scope link  src 10.1.1.1
PUBLIC_IP_VPN_SERVER/24 dev eth0  proto kernel  scope link  src PUBLIC_IP_VPN_SERVER

UPDATE

I used this solution for adding default route in CountryRoute table. So CountryRoute table has this content:

default via 10.1.1.30 dev tun0 

I have active iptables mangle rule (mentioned above) and ip route rules:

ip rule show
0:      from all lookup local
32765:  from all fwmark 0x1 lookup CountryRoute
32766:  from all lookup main
32767:  from all lookup default

But marked traffic still ends on 10.1.1.1 - OpenVPN server, it does not continue to Mikrotik router.

UPDATE2

Currently values:

default via PUBLIC_IP_VPN_SERVER dev eth0
10.0.0.0/24 dev veth0  proto kernel  scope link  src 10.0.0.1
10.0.1.0/24 dev veth3  proto kernel  scope link  src 10.0.1.2
10.1.1.0/24 via 10.1.1.30 dev tun0
10.1.1.30 dev tun0  proto kernel  scope link  src 10.1.1.1
PUBLIC_IP_VPN_SERVER/24 dev eth0  proto kernel  scope link  src PUBLIC_IP_VPN_SERVER

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.1.1.1  P-t-P:10.1.1.30  Mask:255.255.255.255
          inet6 addr: PUBLIC_IP_VPN_SERVER/64 Scope:Global
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:141437 errors:0 dropped:0 overruns:0 frame:0
          TX packets:230785 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:14693683 (14.0 MiB)  TX bytes:240387315 (229.2 MiB)

ip route show table CountryRoute
default via 10.1.1.30 dev tun0

Thank you for your help.

  • The next hop must be determined, and this is what we call routing. However, in an OpenVPN setup each client is one hop away inside the VPN, so I don't understand why you can't use that. You may want to reword the description of your setup, I'm having trouble following it. – Ferenc Wágner Jun 1 at 19:23
  • @FerencWágner many thanks for your reply. I added route table of my OpenVPN server in main post. I need route all marked traffic from tun0 to 10.1.1.30 (VPN IP address of my Mikrotik router). Is it possible please? When I try this: ip route add default via 10.1.1.30 dev tun0 table CountryRoute I get error Network is unreachable... Thanks. – Mato Jun 1 at 21:31
  • I would try adding an explicit route for 10.1.1.30 via tun0. Or make openVPN use a tap rather than tun, so that ARP resolution works for the client. – Ralph Rönnquist Jun 4 at 17:20
  • @RalphRönnquist Thanks. Now I used this solution serverfault.com/questions/642327/… and I have default route to 10.1.1.30, but traffic still does not pass via tun0. Any idea where can be problem please? Thanks. – Mato Jun 4 at 19:24
  • Please update your question with the new information. – Ralph Rönnquist Jun 4 at 19:31
up vote 1 down vote accepted

I think the set up of a network namespace for receiving the Microtek traffic, and route it back with NAT to the actual Microtec could be done via the following, using 10.0.0.0/24 "into" the namespace and 10.0.1.0/24 back out, then routed via the Microtec_VPN_IP

ip netns add Microtek
ip link add veth0 type veth peer name veth1
ip link set veth1 netns Microtek
ip link add veth2 type veth peer name veth3
ip link set veth2 netns Microtek
ifconfig veth0 10.0.0.1/24 up
ifconfig veth3 10.0.1.2/24 up
ip netns exec Microtek ifconfig veth1 10.0.0.2/24 up
ip netns exec Microtek ifconfig veth2 10.0.1.1/24 up
ip netns exec Microtek iptables -t nat -A POSTROUTING -o veth2 -j MASQUERADE
ip netns exec Microtek ip route add Mikrotik_VPN_IP via 10.0.1.2
ip netns exec Microtek ip route add default via Mikrotik_VPN_IP

With that, you have a traffic path to/from the Microtek router by routing it via 10.0.0.2. You also need the rule based routing to pass the selected traffic via 10.0.0.2, and the rest via the "normal"/default route.

  • many thanks! But last command gives me this error: ip netns exec Mikrotik ip route add default via 10.1.1.30 RTNETLINK answers: Network is unreachable – Mato Jun 5 at 19:28
  • You do have 10.1.1.30 via 10.1.1.2 dev tun0 in the default route table? The CountryRoute table should have default via 10.0.0.2. By using a tun rather than tap, the ARP doesn't work, so you can't rely on the network route. – Ralph Rönnquist Jun 5 at 19:38
  • I updated main post with currently values (UPDATE2). So now I have to change default via 10.0.0.2 in CountryRoute? – Mato Jun 5 at 21:09
  • Yes, you want those incoming packets from tun0 to be routed via 10.0.0.2 (the namespace), where they will be routed onwards via 10.1.1.30. With NAT, i.e., they will be sourced from 10.0.1.1. – Ralph Rönnquist Jun 6 at 5:35
  • ok thanks. So now I have: ip route show table ContryRoute: default via 10.0.0.2 dev veth0 But command: ip netns exec Mikrotik ip route add default via 10.1.1.30 still gives error: RTNETLINK answers: Network is unreachable – Mato Jun 6 at 20:54

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.