3

So i have 3 interfaces on a host:

  • Interface 1 is facing the external network
  • interface 2 is the tun0 vpn interface
  • interface 3 the local network interface

My goal is to route all the traffic from interface 3 (the local network) through the vpn interface and all the traffic from the host through the default interface1

# ip route
default via 192.168.1.1 dev eth0
10.8.8.0/24 dev tun0 proto kernel scope link src 10.8.8.27
128.0.0.0/1 via 10.8.8.1 dev tun0
192.168.0.0/24 dev eth2 proto kernel scope link src 192.168.0.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.56

(I have read other posts here but none of them were really helpful)

Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
bit151
  • 43
  • 1
  • 7
  • Which interface is which network? Is eth0 the external and eth2 the LAN? – Andrew Mar 26 '18 at 17:57
  • Do you want to nat or to forward packets? (aka do the hosts on the VPN know how to reach interface 3 IPs) Depending on you needs, you can maybe bridge interface 2 and 3 – Robin Thoni Mar 26 '18 at 21:15

2 Answers2

3

First: the "half-default" route 128.0.0.0/1 (without its other half 0.0.0.0/1 ??) shouldn't exist if the router won't use the tunnel:

# ip route del 128.0.0.0/1 via 10.8.8.1 dev tun0

Since it's most likely set from the tunnel software, deal with its configuration.

Now create a new table (random choice: 100) with a default route through the tunnel, and use it only for traffic from eth2:

# ip route add default via 10.8.8.1 dev tun0 table 100
# ip rule add iif eth2 lookup 100

Tests:

Host is using the usual default route whatever its source IP (as per the question, the selector for the tunnel is from the interface, not the IP):

# ip -o route get 8.8.8.8
8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.56 \    cache
# ip -o route get 8.8.8.8 from 192.168.0.1
8.8.8.8 from 192.168.0.1 via 192.168.1.1 dev eth0 \    cache

The traffic from eth2 will get handled differently:

# ip -o route get 8.8.8.8 from 192.168.0.2 iif eth2
8.8.8.8 from 192.168.0.2 via 10.8.8.1 dev tun0 table 100 \    cache  iif eth2

If you also want the local 192.168.0.1 IP going through the tunnel. It's a bit more complex because 192.168.0.1 needs to send IP packets to its own LAN if needed (and not to tun0 in this case). Requires copying the LAN route also to table 100, adding a rule based on source IP (and then removing the useless previous rule based on interface):

# ip route add 192.168.0.0/24 dev eth2 table 100
# ip rule add from 192.168.0.0/24 lookup 100
( # ip rule del iif eth2 lookup 100 )

Which now gives also:

# ip -o route get 8.8.8.8 from 192.168.0.1
8.8.8.8 from 192.168.0.1 via 10.8.8.1 dev tun0 table 100 \    cache

That's it for routing. Note that without NAT the other end of the tunnel needs a route to 192.168.0.0/24 via 10.8.8.27 or it won't work. This should be the preferred choice.

If this route on remote isn't set, and NAT is good enough instead, configure it with:

# iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE
A.B
  • 11,090
  • 2
  • 24
  • 45
0

You haven't explicitly stated which interface is which, so I'm going to assume:

  • Interface 1 is eth0 (WAN facing)
  • Interface 2 is tun0 (VPN Tunnel)
  • Interface 3 is eth2 (LAN)

You'll want to start by coming up with a routing table name and ID and appending it to the routing table alias file (usually /etc/iproute2/rt_tables) in the form

TABLE_ID   TABLE_NAME

where TABLE_ID is a non reserved positive integer, e.g. 10.

Since you want all packets from eth2 to be routed through the VPN, you'll need to add a default route on this table through the tunnel interface

ip route add default dev tun0 table TABLE_NAME

You'll then need to add a rule to use this table for packets from eth2

ip rule add iif eth2 table TABLE_NAME
Torin
  • 462
  • 1
  • 3
  • 7