On a Debian machine I was having problems connecting to a openVPN server.
The connection could be established, merely in the sense of that an interface would be added and that I would get a 10.130.x.x IP assigned to it, but I could not get any traffic accross the VPN. All traffic would still go over my original public IP address:
root@vps2:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
92.222.32.0 0.0.0.0 255.255.255.0 U 0 0 0 venet0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 venet0
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo
92.222.32.42
root@vps2:~# service openvpn start
[ ok ] Starting virtual private network daemon: myvpn.
root@vps2:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.130.3.137 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
92.222.32.0 0.0.0.0 255.255.255.0 U 0 0 0 venet0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 venet0
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo
92.222.32.42
root@vps2:~#
In my syslog I was able to see the message NOTE: unable to redirect default gateway -- Cannot read current default gateway from system. And some searching led me to find that this was because the default gateway was not set explicitly. I guess the remote VPN is using some kind of client script that does not just expects to find a default gateway set explicitly.
I have tried 2 ways to set my default gateway explicitly. And both work!
First I tried setting my original public IP address as the default gateway, which worked:
route add default gw 92.222.32.42
root@vps2:~# route add default gw 92.222.32.42
root@vps2:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
92.222.32.0 0.0.0.0 255.255.255.0 U 0 0 0 venet0
0.0.0.0 92.222.32.42 0.0.0.0 UG 0 0 0 venet0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 venet0
root@vps2:~# service openvpn start
[ ok ] Starting virtual private network daemon: myvpn.
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo
217.23.15.239
root@vps2:~#But why use my original public IP as the default gateway? I don't know. So I also tried it by setting the first hop from a random traceroute as the default gateway. ANd that also worked:
root@vps2:~# traceroute foo.com
traceroute to foo.com (121.232.122.233), 30 hops max, 60 byte packets
1 49.ip-92-222-50.eu (92.222.50.49) 0.039 ms 0.011 ms 0.012 ms
2 [......... I stop the traceroute when I see the first hop]
^C
root@vps2:~# route add default gw 92.222.50.49root@vps2:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
92.222.32.0 0.0.0.0 255.255.255.0 U 0 0 0 venet0
0.0.0.0 92.222.50.49 0.0.0.0 UG 0 0 0 venet0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 venet0
root@vps2:~# service openvpn start
[ ok ] Starting virtual private network daemon: myvpn.
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo
217.23.15.239
root@vps2:~#
Hooray! I got this far on my own.
Now after connecting to the VPN, the routing gets changed automatically. This is nice and all, but now I lose all connectivity via my original public IP address and my SSH connection gets dropped, my web server is no longer accessible and even other services that I offer. I guess this is because all incoming connections now have responses being routed over the VPN. I would much rather see all connections that come in via my original public IP, to get responses from the same IP. And that the VPN is only be used for connections that my server initiates towards the outside world. I haven't figured out this part yet.
This is how my routing looks like after I connect to the VPN:
root@vps2:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.130.0.1 10.130.3.73 255.255.255.255 UGH 0 0 0 tun0
10.130.3.73 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
217.23.15.239 92.222.32.42 255.255.255.255 UGH 0 0 0 venet0
92.222.32.0 0.0.0.0 255.255.255.0 U 0 0 0 venet0
0.0.0.0 10.130.3.73 128.0.0.0 UG 0 0 0 tun0
128.0.0.0 10.130.3.73 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 92.222.32.42 0.0.0.0 UG 0 0 0 venet0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 venet0
root@vps2:~#
So my questions are:
What should I use as my default gateway, as both methods worked? My original public IP or the first hop in the traceroute? Or something totally different even?
How can I automate this, so the gateway is set automatically when booting? I mean that so on boot the server checks if I a default gateway set, and if not it will then put my public IP or the first hop of the traceroute as the default gateway...
And after finally connecting to the openVPN, how do I prevent losing connectivity via the original public IP address, but still have all outgoing connections use the VPN?
