What I want to achieve
I am contemplating the following setup on my Linux box (a Raspberry Pi v3 under a recent brew of Raspberry Pi OS):
- A VPN client for all the outgoing connections by default
- A VPN server to accomodate incoming connections from the internet to my box
- A "vanilla" interface (eth0 here) to be able to get out of my box while bypassing the deafutl VPN client
I use interface #3 to grab my public IP as delivered by my ISP, i.e. the IP of my home network. E.g. it allows me to successfully update my DNS provider account with my "real" (read non-VPN client) IP:
curl https://my.dns.provider/refresh_my_account_id_query --interface etho
+---------------------------------------------------------------+ +-----------------+ +---------+
| My Linux box | | | | |
| | | My home network | | My ISP |
| | | | | |
| +------------+ | | | | | +------------------+
| | VPN Client | Dev: tun0 | IP:<pre-defined by VPN provider> | | | | | | VPN Provider's |
| | (default <-------------------------------------------------------------------------------------------> Servers <---------+
| | outgoing) | | | | | | | | |
| +------------+ | | | | | +------------------+ |
| | | | | | +------v-----+
| +------------+ | | | | | | |
| | | Dev: tun1 | IP:10.8.0.1 | | | | | | Internet |
| | VPN Server <-----------------------------------------------------------------------------------------------------------------> |
| | | | | | | | | |
| +------------+ | | | | | | |
| | | | | | | |
| +------------+ | | | | | | |
| |Only for | Dev eth0 | IP:192.168.0.200 | | --------------------------------------------------------> |
| |explicit VPN<--------------------------------------------------------/ | | | | |
| |bypass | | | | | | | |
| +------------+ | | | | | +------------+
| | | | | |
| | | | | |
+---------------------------------------------------------------+ +-----------------+ +---------+
The issues I'm facing
I can't have both VPNs (interface tun0 and tun1) working at the same time: when they are both up and configured I can't connect my VPN server from the internet anymore. All the rest works well though. It seems to me that when both the routes and rules for interfaces tun0 and tun1 are setup, all the incoming traffic just goes on one default interface, or is dropped, I'm not sure.
My current setup for each interface
Following the list of interfaces in the my setup description:
- I have setup my VPN client using a plain openvpn config file which is being used by
systemctl
to run the client as a service. This work well on its own, i.e. all the traffic is going through thetun0
interface by default. - I have setup my VPN server using
PiVPN
. This was really simple and would work after just a one-shot try. - I am manually adding
ip route default via 192.168.0.1 dev eth0 proto dhcp src 192.168.0.200 metric 202
and this is working as expected.
When booting the box, all 3 interfaces come up (on top of lo
) and ip route
gives:
0.0.0.0/1 via 172.94.109.161 dev tun0
default via 172.94.109.161 dev tun0
default via 192.168.0.1 dev eth0 proto dhcp src 192.168.0.200 metric 202
10.8.0.0/24 dev tun1 proto kernel scope link src 10.8.0.1
128.0.0.0/1 via 172.94.109.161 dev tun0
172.94.109.4 via 192.168.0.1 dev eth0
172.94.109.160/28 dev tun0 proto kernel scope link src 172.94.109.163
192.168.0.0/24 dev eth0 proto dhcp scope link src 192.168.0.200 metric 202
What I understand from the above is:
- Lines #1 and #2 are the same and are meant to get all my default outgoing traffic through my VPN client as I intend, I should remove one of them though.
- Line #3 is added manually by me and works as I intend to bypass my VPN client should I target directly the eth0 interface, but is it breaking something else?
- Line #4 is meant to get anything received on the VPN server's IP to be managed by tun1, my VPN server
- Line #5 to #8 I have no clue, seems like needed by my VPN client to work properly
What I am asking for
I need another brain to check my understanding of my current IP routes. Then I'm looking for any pointer toward the right approach to achieving the setup described here.
So far I have tried many rules and routes setup built along my researches, without success. I have also read a bit about flagging outgoing and incoming paquets via the mangle
ip rule or route option, but the literature out there is rather hard to digest and I'd like to understand what tools I actually need before trying them further.
Any help would be very appreciated, I'll be happy to provide any detail of config or try any new config, just ask.