0

I am setting up a gateway for my network that includes a reverse proxy (HAProxy) and a openvpn server on the same machine.

I want to use the openvpn to connect to a vpn provider so that all the traffic from my network is encrypted.

The problem now is that as soon as I open up the connection to the vpn provider it pushes new routes to my routing table. Those routes are conflicting with my HAProxy that cannot access my internal servers.

Routing table without connecting to the vpn provider:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
default         192.168.1.1     0.0.0.0         UG    203    0        0 eth1
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     203    0        0 eth1

Routing table after connecting to the vpn provider:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.3.1        128.0.0.0       UG    0      0        0 tun1
default         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
default         192.168.1.1     0.0.0.0         UG    203    0        0 eth1
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.8.3.0        0.0.0.0         255.255.255.0   U     0      0        0 tun1
123.243.152.126 192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.3.1        128.0.0.0       UG    0      0        0 tun1
192.168.100.0   0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     203    0        0 eth1

I followed following guide to setup the routing and nat rules: https://gist.github.com/superjamie/ac55b6d2c080582a3e64

I want to route all trafic that is reaching eth1 through tun1 which is the connection to the vpn provider.

sudo iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
sudo iptables -A FORWARD -i tun1 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o tun1 -j ACCEPT

All the requests on eth0 are not supposed to go through that tunnel. Instead they are meant to go either to my internal servers or respond to request from a client from outside the network.

  • 1
    contrary to (misleading) information often found on net, iptables rarely does routing. It allows routed packets. When it does NAT in POSTROUTING it doesn't route, it did it after routing was done. To do routing, routing commands must be used. For this case it's policy routing, using routing rules to enable multiple tables, thus enabling correct use of multiple default routes (correct use as in one per table) – A.B Apr 24 at 18:59
  • 1
    For starters, there is already something wrong with routing without activating the VPN, there should not be there two default gateways. Furthermore, some VPNs are also configured as full tunnel VPNs, and by design they interfere with the normal routing. This seems more a networking/routing/security question than a Linux question. – Rui F Ribeiro Apr 24 at 19:10
  • 1
    @RuiFRibeiro it's a common OpenVPN's trick: it's creating two half-default routes to take precedence over the actual default route. those routes are /1, not /0. – A.B Apr 24 at 19:12
  • @RuiFRibeiro should I post my question in a different section? – DJMcMuffin Apr 24 at 19:15
  • Well I'm attempting to provide a linux solution, so afaik that stays on topic here. Can't promise I give it soon or at all though. – A.B Apr 24 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.