1

I have VPN network based on OpenVPN software. I need route all network traffic in VPN network where destination IP is from specific country via one specific client on this VPN network (VPN client IP address) - Mikrotik router where is configured NAT (MASQUERADE) for main internet interface (PPPoE). I need get public, dynamic IP address owned by this VPN client (Mikrotik router - PPPoE interface) for all this traffic. So on VPN server I created iptables mangle rule and I use geoip iptables module:

iptables -A PREROUTING -t mangle -i tun0 -m geoip --destination-country COUNTRY_CODE -j MARK --set-mark 1

So I have marked all traffic from client which have destination IP from this specific country. Next I have tried use this solution: Create specific route table and add default route. But default route can be only for next hop on this network. So when I use this command:

ip route add default via specific_VPN_client dev tun0 table CountryRoute

I get this error:

RTNETLINK answers: Network is unreachable

Is possible route specific traffic to specific client, but not to next hop please?

I tried this iptables rule too:

iptables -A PREROUTING -i tun0 -m geoip --destination-country COUNTRY_CODE -j DNAT --to-destination Mikrotik_VPN_IP

But traffic ends on Mikrotik router. Maybe would be possible solve this problem on this router?

OpenVPN server (10.1.1.1) route table:

default via PUBLIC_IP_VPN_SERVER dev eth0
10.1.1.0/24 via 10.1.1.2 dev tun0
10.1.1.2 dev tun0  proto kernel  scope link  src 10.1.1.1
PUBLIC_IP_VPN_SERVER/24 dev eth0  proto kernel  scope link  src PUBLIC_IP_VPN_SERVER

UPDATE

I used this solution for adding default route in CountryRoute table. So CountryRoute table has this content:

default via 10.1.1.30 dev tun0

I have active iptables mangle rule (mentioned above) and ip route rules:

ip rule show
0:      from all lookup local
32765:  from all fwmark 0x1 lookup CountryRoute
32766:  from all lookup main
32767:  from all lookup default

But marked traffic still ends on 10.1.1.1 - OpenVPN server, it does not continue to Mikrotik router.

UPDATE2

Currently values:

default via PUBLIC_IP_VPN_SERVER dev eth0
10.0.0.0/24 dev veth0  proto kernel  scope link  src 10.0.0.1
10.0.1.0/24 dev veth3  proto kernel  scope link  src 10.0.1.2
10.1.1.0/24 via 10.1.1.30 dev tun0
10.1.1.30 dev tun0  proto kernel  scope link  src 10.1.1.1
PUBLIC_IP_VPN_SERVER/24 dev eth0  proto kernel  scope link  src PUBLIC_IP_VPN_SERVER

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.1.1.1  P-t-P:10.1.1.30  Mask:255.255.255.255
          inet6 addr: PUBLIC_IP_VPN_SERVER/64 Scope:Global
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:141437 errors:0 dropped:0 overruns:0 frame:0
          TX packets:230785 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:14693683 (14.0 MiB)  TX bytes:240387315 (229.2 MiB)

ip route show table CountryRoute
default via 10.1.1.30 dev tun0

UPDATE 3

ip -4 route show table all
default via 10.0.0.2 dev veth0 table CountryRoute
default via PUBLIC_IP_VPN_SERVER_gateway dev eth0 onlink
10.0.0.0/24 dev veth0 proto kernel scope link src 10.0.0.1
10.0.1.0/24 dev veth3 proto kernel scope link src 10.0.1.2
10.1.1.0/24 via 10.1.1.30 (Mikrotik_VPN_IP) dev tun0
10.1.1.30 dev tun0 proto kernel scope link src 10.1.1.1
PUBLIC_IP_VPN_SERVER/24 dev eth0 proto kernel scope link src PUBLIC_IP_VPN_SERVER
broadcast 10.0.0.0 dev veth0 table local proto kernel scope link src 10.0.0.1
local 10.0.0.1 dev veth0 table local proto kernel scope host src 10.0.0.1
broadcast 10.0.0.255 dev veth0 table local proto kernel scope link src 10.0.0.1
broadcast 10.0.1.0 dev veth3 table local proto kernel scope link src 10.0.1.2
local 10.0.1.2 dev veth3 table local proto kernel scope host src 10.0.1.2
broadcast 10.0.1.255 dev veth3 table local proto kernel scope link src 10.0.1.2
local 10.1.1.1 dev tun0 table local proto kernel scope host src 10.1.1.1
broadcast PUBLIC_IP_VPN_SERVER_networkIP dev eth0 table local proto kernel scope link src PUBLIC_IP_VPN_SERVER
local PUBLIC_IP_VPN_SERVER dev eth0 table local proto kernel scope host src PUBLIC_IP_VPN_SERVER
broadcast PUBLIC_IP_VPN_SERVER_broadcastIP dev eth0 table local proto kernel scope link src PUBLIC_IP_VPN_SERVER
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1

UPDATE 4

ip netns exec Mikrotik ip -4 route show table all
default via 10.0.1.2 dev veth2
10.0.0.0/24 dev veth1 proto kernel scope link src 10.0.0.2
10.0.1.0/24 dev veth2 proto kernel scope link src 10.0.1.1
10.1.1.30 via 10.0.1.2 dev veth2
broadcast 10.0.0.0 dev veth1 table local proto kernel scope link src 10.0.0.2
local 10.0.0.2 dev veth1 table local proto kernel scope host src 10.0.0.2
broadcast 10.0.0.255 dev veth1 table local proto kernel scope link src 10.0.0.2
broadcast 10.0.1.0 dev veth2 table local proto kernel scope link src 10.0.1.1
local 10.0.1.1 dev veth2 table local proto kernel scope host src 10.0.1.1
broadcast 10.0.1.255 dev veth2 table local proto kernel scope link src 10.0.1.1

UPDATE 5

# ip netns exec Mikrotik traceroute -I 10.1.1.30
traceroute to 10.1.1.30 (10.1.1.30), 30 hops max, 60 byte packets
 1  10.0.1.2 (10.0.1.2)  0.053 ms  0.016 ms  0.013 ms
 2  10.1.1.30 (10.1.1.30)  18.868 ms  38.147 ms  98.549 ms

# ip netns exec Mikrotik traceroute 10.1.1.30
traceroute to 10.1.1.30 (10.1.1.30), 30 hops max, 60 byte packets
 1  10.0.1.2 (10.0.1.2)  0.056 ms  0.019 ms  0.016 ms
 2  10.1.1.30 (10.1.1.30)  19.044 ms  37.808 ms  56.347 ms

# ip netns exec Mikrotik traceroute COUNTRY_PUBLIC_IP_MARKED_TRAFFIC
traceroute to COUNTRY_PUBLIC_IP_MARKED_TRAFFIC (COUNTRY_PUBLIC_IP_MARKED_TRAFFIC), 30 hops max, 60 byte packets
 1  10.0.1.1 (10.0.1.1)  3052.269 ms !H  3052.212 ms !H  3052.185 ms !H

# ip netns exec Mikrotik traceroute -I COUNTRY_PUBLIC_IP_MARKED_TRAFFIC
traceroute to COUNTRY_PUBLIC_IP_MARKED_TRAFFIC (COUNTRY_PUBLIC_IP_MARKED_TRAFFIC), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * 10.0.1.1 (10.0.1.1)  3067.929 ms !H  3067.883 ms !H

Thank you for your help.

Improve this question
9
  • The next hop must be determined, and this is what we call routing. However, in an OpenVPN setup each client is one hop away inside the VPN, so I don't understand why you can't use that. You may want to reword the description of your setup, I'm having trouble following it.
    – Ferenc Wágner
    Commented Jun 1, 2018 at 19:23
  • @FerencWágner many thanks for your reply. I added route table of my OpenVPN server in main post. I need route all marked traffic from tun0 to 10.1.1.30 (VPN IP address of my Mikrotik router). Is it possible please? When I try this: ip route add default via 10.1.1.30 dev tun0 table CountryRoute I get error Network is unreachable... Thanks.
    – Mato
    Commented Jun 1, 2018 at 21:31
  • I would try adding an explicit route for 10.1.1.30 via tun0. Or make openVPN use a tap rather than tun, so that ARP resolution works for the client.
    – Ralph Rönnquist
    Commented Jun 4, 2018 at 17:20
  • @RalphRönnquist Thanks. Now I used this solution serverfault.com/questions/642327/… and I have default route to 10.1.1.30, but traffic still does not pass via tun0. Any idea where can be problem please? Thanks.
    – Mato
    Commented Jun 4, 2018 at 19:24
  • Please update your question with the new information.
    – Ralph Rönnquist
    Commented Jun 4, 2018 at 19:31

1 Answer 1

Reset to default
1

I think the set up of a network namespace for receiving the Mikrotik traffic, and route it back with NAT to the actual Mikrotik could be done via the following, using 10.0.0.0/24 "into" the namespace and 10.0.1.0/24 back out, then routed via the Mikrotik_VPN_IP 

ip netns add Mikrotik
ip link add veth0 type veth peer name veth1
ip link set veth1 netns Mikrotik
ip link add veth2 type veth peer name veth3
ip link set veth2 netns Mikrotik
ifconfig veth0 10.0.0.1/24 up
ifconfig veth3 10.0.1.2/24 up
ip netns exec Mikrotik ifconfig veth1 10.0.0.2/24 up
ip netns exec Mikrotik ifconfig veth2 10.0.1.1/24 up
ip netns exec Mikrotik iptables -t nat -A POSTROUTING -o veth2 -j MASQUERADE
ip netns exec Mikrotik ip route add Mikrotik_VPN_IP via 10.0.1.2
ip netns exec Mikrotik ip route add default via Mikrotik_VPN_IP dev veth2 onlink
ip netns exec Mikrotik iptables -A PREROUTING -t mangle -j MARK --set-mark 0

With that, you have a traffic path to/from the Microtek router by routing it via 10.0.0.2. You also need the rule based routing to pass the selected traffic via 10.0.0.2, and the rest via the "normal"/default route.

Improve this answer
39
  • many thanks! But last command gives me this error: ip netns exec Mikrotik ip route add default via 10.1.1.30 RTNETLINK answers: Network is unreachable
    – Mato
    Commented Jun 5, 2018 at 19:28
  • You do have 10.1.1.30 via 10.1.1.2 dev tun0 in the default route table? The CountryRoute table should have default via 10.0.0.2. By using a tun rather than tap, the ARP doesn't work, so you can't rely on the network route.
    – Ralph Rönnquist
    Commented Jun 5, 2018 at 19:38
  • I updated main post with currently values (UPDATE2). So now I have to change default via 10.0.0.2 in CountryRoute?
    – Mato
    Commented Jun 5, 2018 at 21:09
  • Yes, you want those incoming packets from tun0 to be routed via 10.0.0.2 (the namespace), where they will be routed onwards via 10.1.1.30. With NAT, i.e., they will be sourced from 10.0.1.1.
    – Ralph Rönnquist
    Commented Jun 6, 2018 at 5:35
  • ok thanks. So now I have: ip route show table ContryRoute: default via 10.0.0.2 dev veth0 But command: ip netns exec Mikrotik ip route add default via 10.1.1.30 still gives error: RTNETLINK answers: Network is unreachable
    – Mato
    Commented Jun 6, 2018 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .