0

I have a web server which serves a site on port 3000. This web server is accessible on my local network (https://172.16.1.16:3000) but I need it to be accessible from the internet via multiple URLs.

To do this I am using AirDNS to provide the URLS and port forwarding. The web server has three OpenVPN clients which independently connect to the AirDNS OpenVPN servers.
The three OpenVPN servers are:
OpenVPN Server 1) subdomain1.airdns.com - forwards port 3400 to 3000
OpenVPN Server 2) subdomain2.airdns.com - forwards port 36544 to 3000
OpenVPN Server 3) subdomain3.airdns.com - forwards port 28448 to 3000

Currently each VPN connection works independently, or, if I connect the web server to multiple AirDNS servers then only the last server works.
So if the web server is connected to OpenVPN server 1 then from the internet I can browse to https://subdomain1.airdns.com:3400 and I get the site no problem. If I then connect the web server to to OpenVPN server 2 I can successfully browse to https://subdomain2.airdns.com:36544 but https://subdomain1.airdns.com:3400 stops working. If I then connect the web server to the third OpenVPN server then https://subdomain3.airdns.com:28448 works and the URL provided by OpenVPN server 2 stops working.

I initially thought the issue was OpenVPN setting default gateway rules so I added pull-filter ignore redirect-gateway to the OpenVPN configs on the web server. This does indeed stop OpenVPN from setting the 0.0.0.0/1 and 128.0.0.0/1 routes. However this also breaks being able to hit the page from any of the AirDNS URLs.

I've also tried using IP Tables to setup IP Forwarding on the webserver so that any traffic arriving on any interface with destination port of 3000 is forwarded with masquerading to the web servers LAN IP (172.16.1.16:3000).

The rules I tried, which I think should work, (in conjunction with the ignore redirect-gateway OpenBPN option) are:

sudo iptables -t nat -A POSTROUTING -o lo -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 172.16.1.16:3000

Other iptables rules applied are:
1) Always allow loopback traffic:
sudo iptables -A INPUT -i lo -j ACCEPT
2) Always allow traffic on LAN interface:
sudo iptables -A INPUT -i ens160 -m state --state RELATED,ESTABLISHED -J ACCEPT
3) Always allow traffic in the Forward chain:
sudo iptables -A FORWARD -j ACCEPT

IP forwarding is enabled in /etc/sysctl.conf

The server is running Ubuntu 18.04.2 Server.

Any help on how to make it so that the site served by the web server is accessible via all three of the AirDNS URLs at the same time would be much appreciated.

Diagram

  • First thing I'd try: Assuming you can control your OpenVPN settings so that the each of the 3 tun interfaces gets assigned a different IP, make your web server listen on all 3 interfaces, and hope the web server is capable of chosing the right interface for the response. If this doesn't work, use policy routing to enforce the right interface based on source address. – dirkt May 13 at 11:30
  • Thanks for the reply. The web server is listening on 0.0.0.0 which should mean all interfaces, this seems to be the case as I can curl the site on 127.0.0.1:3000, 172.16.1.16:3000 and externally via the public URL on whichever was the last connected AirDNS OpenVPN server. I'll look into policy routing. Thanks. – A. Gibson May 13 at 11:36
0

Many thanks to dirkt, policy routing was the way to go.

I added three additional routing tables each with a default route and an ip rule.

The commands I used were:

echo "13 tun0" | sudo tee -a /etc/iproute2/rt_tables
sudo ip rule add from 10.35.0.104 lookup tun0
sudo ip route add default via 10.35.0.1 table tun0

echo "14 tun1" | sudo tee -a /etc/iproute2/rt_tables
sudo ip rule add from 10.25.0.127 lookup tun1
sudo ip route add default via 10.25.0.1 table tun1

echo "15 tun2" | sudo tee -a /etc/iproute2/rt_tables
sudo ip rule add from 10.15.0.223 lookup tun2
sudo ip route add default via 10.15.0.1 table tun2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.