Routing traffic through VPN using Raspberry PI

Question

I have a setup like this:

• Raspberry Pi connected to router via LAN cable
• Created a bridged connection between eth0 and wlan0
• Using hostapd for Wi-Fi hotstop
• Configured l2tp/ipsec connection with one of my servers online

An Issue I am having & goal:

• Goal is to have this Raspberry Pi as a Wi-Fi router that would route all traffic coming via Wi-Fi through my VPN
• Issue I am having is that Raspberry Pi is using the VPN tunnel when I do curl, but all Wi-Fi guests connected do not get the VPN IP.

Interface example:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether b8:27:eb:21:2b:9a brd ff:ff:ff:ff:ff:ff
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b8:27:eb:21:2b:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.7/24 brd 192.168.1.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::ba27:ebff:fe21:2b9a/64 scope link
       valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether b8:27:eb:74:7e:cf brd ff:ff:ff:ff:ff:ff
6: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc pfifo_fast state UNKNOWN group default qlen 3
    link/ppp
    inet 192.168.42.11 peer 192.168.42.1/32 scope global ppp0
       valid_lft forever preferred_lft forever

Routing table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 ppp0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 br0
45.36.81.212    192.168.1.1     255.255.255.255 UGH   0      0        0 br0
63.126.53.74    192.168.1.1     255.255.255.255 UGH   0      0        0 br0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
192.168.42.1    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0

45.36.81.212 is my VPN
63.126.53.74 is my own local public IP
(ips have been slightly changed for obvious reasons).

OS: Raspbian

Would forwarding wlan0 to ppp0 do the trick, or do I need to tamper with br0?

Answer 1

I have a similar set up where some clients use a gateway that is a VPN-tunneled device, and others use the regular old ISP delivered internet connection to the house.

I do not bridge my wifi and ethernet on the VPN gateway. Instead, that machine runs a VPN client. This forces the VPN gateway to examine the routing table to deal with traffic, which a bridge would bypass.

On the VPN gateway I have three IPs:

• eth0: 192.168.1.254 basically just a client on my main network
• eth1: 192.168.2.1 the gateway for the alternate network
• tun0: 10.2.3.5 this is a VPN tunnel, and the IP is different every time the tunnel comes up

I also maintain 3 static routes on the VPN gateway:

• default router -> 192.168.1.1
• 0.0.0.0/1 -> 10.2.3.5
• 128.0.0.0/1 -> 10.2.3.5

And one important dynamic route for the VPN: - 10.2.3.5 -> 10.2.3.6

The default route to my ISP gateway (192.168.1.1) ensures that the VPN gateway will always be able to find the internet.

The other two routes are two "more specific" routes that happen to encompass all of IPv4 address space. So any traffic to anywhere (other than any directly connected networks) is passed to the VPN tunnel interface, and the specific dynamic route of the VPN tunnel 10.2.3.5 -> 10.2.3.6 passes all that traffic across the tunnel.

In this way, all clients accessing the Wifi via the VPN Gateway are routed out the VPN tunnel, and I can still have clients access my ISP network (wifi) to get general internet access if needed or desired.