Rich Freeman on 28 Sep 2014 04:44:05 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] OpenVPN Question


On Sat, Sep 27, 2014 at 10:42 PM, Keith C. Perry
<kperry@daotechnologies.com> wrote:
>
> Also, I'm not sure how these "containers" fit into the equation.
> Sounds like a docker or VM thing- are you trying to NAT (actually port
> forward would be the term) traffic to certain "containers" once the
> OpenVPN connection is established?
>

Imagine a physical linux box with one NIC eth0 - IP is 192.168.0.1.
You launch openvpn and now you have tun0 with IP of 10.0.0.1.

I want to forward all traffic received on eth0 to tun0.

Now, imagine that this isn't a physical box, but just a container.
So, instead of eth0 the "NIC" is a virtual interface vb-vpn which is
connected to a bridge interface brhost on the host which is connected
to the eth0 on the host.  brhost has the IP which the incoming
connections from the router happen to be coming in on.

So, within the container the iptables rules should NAT all connections
from vb-vpn to tun0.  Outside of the container the iptables rules on
the host should not interfere with traffic bound for containers (which
have their own IPs), but they should ensure that reply traffic coming
in for the host goes out to the real router and not to the vpn
container running on the host.

I believe Lee actually does something similar but he is doing it with
vmware and he wouldn't have anything running on the host as a result
other than whatever kind of management interface it has, and whatever
solution vmware has for virtual networking isn't going to work for
linux in general.

My "real" router is still running openwrt (which is also based on
linux).  It does fine, but the CPU is underpowered for putting 50Mbps
over the VPN.

--
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug