0

I am running an OpenVPN server on a debian based VM for a number of clients and, for many complicated reasons, I would like to have this system connect to another (external) OpenVPN server, so that my client's traffic passes my virtual system and the external VPN on the way to the world wide web. As the external VPN server is also running OpenVPN, I figured my virtual system could simply act as a go-between, being an OpenVPN client of the external VPN provider and an OpenVPN server for my clients. But when I tried to set this up, the devices of the OpenVPN instances seemed to interfere with each other.

Essentially, the set-up I want is this: clients --> [my VM#1 with openvpn server] --> [my VM#2 with vpn service provider client] -> internet. I was hoping somebody more knowledgeable than me may be able to offer advice on how to go about setting this up.


VM#1 [openvpn server]

root@buster:~#cat /etc/openvpn/server/server.conf
port 1199
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem


ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.33.10  netmask 255.255.255.0  broadcast 192.168.33.255

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1


route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG    0      0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.33.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1

openvpn server port 1199 already forwarded to host machine

======================

VM#2 [external service vpn client connected]

root@buster:~#cat external-client.ovpn
client
dev tun
proto tcp
remote *.*.*.* 1188
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>


ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.33.11  netmask 255.255.255.0  broadcast 192.168.33.255

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.2  netmask 255.255.255.0  destination 10.8.0.2


route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         10.0.2.2        0.0.0.0         UG    0      0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
*external-client-ip* 10.0.2.2        255.255.255.255 UGH   0      0        0 eth0
192.168.33.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
3
  • Your OpenVPN server and your OpenVPN client must use different local ports. If they already are doing this you're going to need to post your OpenVPN configurations, IP addresses and network routes May 17, 2021 at 13:11
  • You can add configurations to your question by clicking edit. I've copied from the answer post you gave. You can click delete on that answer. May 17, 2021 at 13:41
  • @Philip Couling thanks!
    – someone156
    May 17, 2021 at 13:46

1 Answer 1

0

Without having seen your two server configurations, my guess would be you forgot to give the two VPN servers different IPv4 subnets.

In the configuration for one you might have the line:

server 10.8.0.0 255.255.255.0

So in the other you will need another subnet. Eg:

server 10.9.0.0 255.255.255.0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .