Score:0

Route OpenVPN traffic via vNIC

hk flag

I'm cracking my brains on the following, and I hope you guys can help me out.

I'm trying to setup an OpenVPN server on a Raspbian distro. Since I'm also using this server as a DNS server in multiple vLANs, I created multiple vNICs with VLAN tagging etc. Works all fine for a while now.

But now I want an additional vLAN for only my OpenVPN traffic. So this is what I did:

  • I added an additional vNIC (eth0.110) and gave it an IP (let's say 10.0.110.10)
  • let OpenVPN listen on this address
  • did FULLNAT on my firewall appliance to; this local IP, from source; firewall interface IP (10.0.110.254)
  • Sidenote: Firewall acts as gateway for every vLAN

I'm so far that my VPN client is able to connect to the OpenVPN server over the internet and is able to ping devices in the .110 vLAN.

The problem is, that I cant find a way to reach internal services in other vLANs than 110.

  • I tried a lot of iptables rules, also with default policy ACCEPT
  • I tried multiple static routes on OpenVPN server
  • I'm pushing routes through the OpenVPN server config, which are being created on the Windows client
  • I tried different IP Pool subnets for VPN clients (currently 10.0.24.0/24).

Current static routes:

default         10.0.10.1       0.0.0.0         UG    0      0        0 eth0
10.0.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0.1
10.0.10.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.15.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0.15
10.0.24.0       10.0.24.2       255.255.255.0   UG    0      0        0 tun0
10.0.24.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.0.110.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0.110

Current iptables:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     4199  627K ACCEPT     all  --  eth0.110 *     0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
2      834 50184 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
3        0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out       source               destination
1     1906  136K ACCEPT     all  --  tun+   *         0.0.0.0/0            0.0.0.0/0
2        0     0 ACCEPT     all  --  tun+   eth0.110  0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
3        3   180 ACCEPT     all  --  eth0.110 tun+    0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
None

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
None

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
None

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    1    60 MASQUERADE  all  --  any    eth0.110  10.0.24.0/24         anywhere

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
None

Long story short. I would like to route my VPN traffic over the vNIC designed for VPN traffic (VLAN 110) (it seems this is working now). Next, I want my firewall appliance to handle the routing between subnets. I've made rules for both the VPN IP Pool and .110 vLAN, but something doesnt work correctly as I still cant reach these services. Is what Im trying possible, or do I have to do the routing with iptables on the OpenVPN server?

I hope any of you can push me into the right direction, thanks in advance! :)

Edit: Also I made IPv4 forwarding possible to set the value to '1'

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.