0

I want to make portable Raspberry PI 4 WiFi AP with VPN, so once I connect to AP all my traffic should go through VPN.

The official Raspberry Pi documentation helped me to setup working WiFi access point wlan0.

Then I installed openconnect and successfully connected to VPN server, which created tun0 interface(device)

sudo apt-get install openconnect
echo "pwd" | sudo openconnect server --user=username --passwd-on-stdin --no-cert-check

I don't want to have any vpn apps on my laptop, so I decided to delegate VPN logic to Raspberry PI.

Question

How to configure my raspberry network interfaces so when I connect to it's WiFi AP - I should be able to have regular traffic(internet) plus I should be able to open enterprise resources behind that VPN as well?

Here is my current network diagram: enter image description here And how it should be in order to pass all traffic thru VPN (if I am not wrong): enter image description here

satellite@rpi:~ $ ifconfig

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.159  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::a099:323a:23e:9571  prefixlen 64  scopeid 0x20<link>
        ether e4:5f:01:46:cd:70  txqueuelen 1000  (Ethernet)
        RX packets 1274  bytes 303233 (296.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1154  bytes 176368 (172.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 22  bytes 2979 (2.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 22  bytes 2979 (2.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1390
        inet 172.22.210.7  netmask 255.255.255.255  destination 172.22.210.7
        inet6 fe80::f321:cf7e:946:1201  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 4  bytes 1091 (1.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13  bytes 1127 (1.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.1  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::8c52:f42c:da7b:3416  prefixlen 64  scopeid 0x20<link>
        ether e4:5f:01:46:cd:71  txqueuelen 1000  (Ethernet)
        RX packets 530  bytes 94983 (92.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 543  bytes 196814 (192.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

satellite@rpi:~ $ sudo iptables --table nat --list

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

satellite@rpi:~ $ sudo iptables -t nat -S

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE

satellite@rpi:~ $ ip route

default via 192.168.0.1 dev eth0 proto dhcp src 192.168.0.159 metric 202
10.0.0.0/8 dev tun0 scope link
82.151.106.133 via 192.168.0.1 dev eth0 src 192.168.0.159
172.12.244.0/24 dev tun0 scope link
172.16.0.0/12 dev tun0 scope link
172.22.210.0/24 dev tun0 scope link
172.30.11.2 dev tun0 scope link
192.168.0.0/24 dev eth0 proto dhcp scope link src 192.168.0.159 metric 202
192.168.0.0/16 dev tun0 scope link
192.168.10.0/24 dev wlan0 proto dhcp scope link src 192.168.10.1 metric 303

And here are some routes I saw in CiscoAnyConnect when I used VPN on Windows:

Cisco AnyConnect Secure Mobility Client 4.10.03104  
(Sat Jul  2 22:31:32 2022)

Secured Routes (IPv4)
  172.16.0.0/12
  192.168.0.0/16
  10.0.0.0/8
  172.12.244.0/24
  172.30.11.2/32
Improve this question
7
  • All traffic, even the traffic that your VPN server doesn't route by default?
    – u1686_grawity
    Jul 2, 2022 at 19:40
  • @user1686, gues I was wrong. I need that VPN in order to be able open enterprise resources (e.g. git, jira e.t.c). So, will update question. Thank you
    – Evgheni Calcutin
    Jul 2, 2022 at 19:42
  • Ok, then the next question is, why do you think the traffic to those addresses isn't already going over the VPN?
    – u1686_grawity
    Jul 2, 2022 at 19:51
  • @user1686, I ssh-ed to PI, from there I connected to VPN, so tun0 created. Then, from another notebook I joined PI's AP and I am able to surf websites but I am unable to visit specific resources. If I use CiscoAnyConnect from windows - I am able to visit company's resources.
    – Evgheni Calcutin
    Jul 2, 2022 at 19:54
  • What iptables NAT rules do you have? Post an iptables-save or iptables -t nat -S – is there a rule for masquerade on tun0? (You need one since your company's network can't route back to your home LAN.)
    – u1686_grawity
    Jul 2, 2022 at 19:59

1 Answer 1

Reset to default
0

The VPN connection was working OK for steps described in question. Issue was with DNS.

I have had to manually set DNS server to DHCP conf in /etc/dhcpcd.conf with static domain_name_servers=8.8.8.8 x.x.x.x where x.x.x.x - VPN's company DNS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .