I'm cracking my brains on the following, and I hope you guys can help me out.
I'm trying to setup an OpenVPN server on a Raspbian distro. Since I'm also using this server as a DNS server in multiple vLANs, I created multiple vNICs with VLAN tagging etc. Works all fine for a while now.
But now I want an additional vLAN for only my OpenVPN traffic. So this is what I did:
- I added an additional vNIC (eth0.110) and gave it an IP (let's say 10.0.110.10)
- let OpenVPN listen on this address
- did FULLNAT on my firewall appliance to; this local IP, from source; firewall interface IP (10.0.110.254)
- Sidenote: Firewall acts as gateway for every vLAN
I'm so far that my VPN client is able to connect to the OpenVPN server over the internet and is able to ping devices in the .110 vLAN.
The problem is, that I cant find a way to reach internal services in other vLANs than 110.
- I tried a lot of iptables rules, also with default policy ACCEPT
- I tried multiple static routes on OpenVPN server
- I'm pushing routes through the OpenVPN server config, which are being created on the Windows client
- I tried different IP Pool subnets for VPN clients (currently 10.0.24.0/24).
Current static routes:
default 10.0.10.1 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0.1
10.0.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.0.15.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0.15
10.0.24.0 10.0.24.2 255.255.255.0 UG 0 0 0 tun0
10.0.24.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.0.110.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0.110
Current iptables:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 4199 627K ACCEPT all -- eth0.110 * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
2 834 50184 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
3 0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 1906 136K ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT all -- tun+ eth0.110 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
3 3 180 ACCEPT all -- eth0.110 tun+ 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
None
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
None
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
None
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1 60 MASQUERADE all -- any eth0.110 10.0.24.0/24 anywhere
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
None
Long story short. I would like to route my VPN traffic over the vNIC designed for VPN traffic (VLAN 110) (it seems this is working now). Next, I want my firewall appliance to handle the routing between subnets. I've made rules for both the VPN IP Pool and .110 vLAN, but something doesnt work correctly as I still cant reach these services. Is what Im trying possible, or do I have to do the routing with iptables on the OpenVPN server?
I hope any of you can push me into the right direction, thanks in advance! :)
Edit: Also I made IPv4 forwarding possible to set the value to '1'