Routing issue - use vpn gateway router

Question

Dear Raspberry community,

I am using a raspberry with newest stretch version and facing a routing issue. My network:

LAN: 192.168.178.0/24
Subnet mask 255.255.255.0
Default eth0 Gateway 192.168.178.1
(this network is connected to the raspberry)

Second available VPN Network (not yes used in Raspberry)
VPNLAN: 192.168.1.0/24
Subnet mask 255.255.255.0
Default eth0 Gateway 192.168.1.1

I want the setup like this: I want to access from all devices in my LAN to the raspberry (that already works perfect).

If it comes to internet (running updates in the raspberry or any other traffic caused my software in the raspberry) the (internet) traffic should be routed through the VPNLAN.

I think, therefore I have to add a routing and have as the only gateway the address of the vpnlan (192.168.1.1).

I am not an expert , tried some setting with route adding etc..nevertheless it did not work.

I added a route through the wan connection to the vpn network - that did not work. How can I connect to the vpn router through the eth0 (192.168.178.0/24) network.... I tried it like this:

ip route add 192.168.1.0/24 via 192.168.178.101   # (WAN 192.168.178.101 from LAN network).

I do not want to solve that for the entire network, just for the raspberry. How do I realize that, what kind of commands do I have to use here? How can I send internet bound traffic to the vpn router?

Update:
I now followed your advice and startet the vpn client on the raspberry. her is the output of the requested commands:

ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:19:cc:e0 brd ff:ff:ff:ff:ff:ff
    inet 192.168.178.35/24 brd 192.168.178.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::32a4:b141:4a75:79a2/64 scope link
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.16.33.194/24 brd 10.16.33.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::b3be:ceaf:ad86:696c/64 scope link flags 800
       valid_lft forever preferred_lft forever

> ip route
0.0.0.0/1 via 10.16.33.1 dev tun0
default via 192.168.178.1 dev eth0 src 192.168.178.35 metric 202
10.16.33.0/24 dev tun0 proto kernel scope link src 10.16.33.194
128.0.0.0/1 via 10.16.33.1 dev tun0
192.168.2.0/24 via 192.168.178.1 dev eth0
192.168.178.0/24 dev eth0 proto kernel scope link src 192.168.178.35 metric 202
213.152.028.210 via 192.168.178.1 dev eth0

Does that help...I want to make sure that the entire internet traffic is routed through the tun0 connection. Request from 192.168.2.0/24 should not be routet through the network and if tun0 is down, no internet connection should be possible immediately.

I have a local network (192.168.178.0/24) and a remote network (192.168.2.0/24) that are connected via a router vpn connection(2xfritzbox). It is possible that I reach every device from one to the other network - works great. My Raspberry is 192.168.178.35, has different software running and openvpn as well. i like to achieve that the ext. traffic from the raspberry to the internet is routet through the openvpn connection and everything else should stay, so that Rasp. can still be reached over the local networks ..

Is it possible at all? and how?

Thank you very much for your great help.

Warm regards Stefan

Answer 1

You potentially have multiple problems here, but I'll try to address the first ones in order. You may need to come back with another question later.

First, your routing is wrong. You want to send the default traffic to the VPN gateway and send only local traffic to the local network. What you've got looks like you're telling the Pi to send all traffic destine to an IP on the VPN network to the Pi itself, which is circular and futile. You probably are not generating any traffic with IPs on that network in the situation that you described, so this rule won't trigger, but if it did it would not lead to messages going out. (I'm under the impression here that 192.168.178.101 is the ip address of the Pi, but that won't ultimately matter in the correct routing.) So you want your routing to look like this:

Destination    Gateway         Genmask
default        192.168.1.1     0.0.0.0
192.168.178.0  0.0.0.0         255.255.255.0

(I've dropped the last few columns.)

Depending on the state you've gotten your routes into, that may or may not require adding or dropping routes from what you have.

Now this probably won't get you up yet because you need the return routes set properly too, i.e. this should get outgoing messages heading in the right direction, but the upstream gateway also needs routing to get the return message back to your machine. That may or may not go immediately depending on how the VPN itself is configured.

Also, as noted in the comments, this sort of thing typically is not set by routing manually. (Although I do have a single machine on my system that does do it that way.) Often you connect to the VPN using some client software and that handles this part for you through policies or by modifying the routing tables automatically.

Answer 2

First a summary of the information as far as I understand it.

   10.16.33.194                                         10.16.33.1
       /               VPN tunnel       ┌────────────────┐   \
      ╔══════════════════╗ ╔════════════╪════════════════╪═══ VPN-Server
      ║                  ║ ║     VPN    │ 213.152.28.210 ┼────┘
   (tun0)                ║ ║ ╔══════════╪═══╗            │
RPi(eth0) <------------> router1 <----> │   ║            │
      \       wired     /         wan   │   ║            │
 192.168.178.35    192.168.178.1        │   ║            │
                                        │   ║ INTERNET   │
                                        │   ║            │
                                  wan   │   ║            │
192.168.2.0/24 <-------> router2 <----> │   ║            │
                        /    ╚══════════╪═══╝            │
                 192.168.2.1            ╰────────────────┘
               Internet Gateway

I assume that the route to host 213.152.028.210 via the router (192.168.178.1) is to the VPN server on the internet (outer ip address).

The following is unclear:

• Subnet 192.168.1.0/24 (VPNLAN?)
• Subnet 192.168.2.0/24: there is a route to it via the router (192.168.178.1)
• Subnet 0.0.0.0/1: there is a route to it through the VPN tunnel
• Subnet 128.0.0.0/1: there is a route to it through the VPN tunnel

I don't know for what this all is needed and what you have running that makes it. I simply ignore it for now.

For your needs the routing table should look similar to this:

default via 10.16.33.1 dev tun0 src 10.16.33.194 metric 202
10.16.33.0/24 dev tun0 proto kernel scope link src 10.16.33.194 metric 202
192.168.178.0/24 dev eth0 proto kernel scope link src 192.168.178.35 metric 202
213.152.28.210 via 192.168.178.1 dev eth0

This will define the virtual private network 10.16.33.0/24 and the local area network 192.168.178.0/24. All traffic not belonging to the LAN is send through the VPN tunnel except to the single host 213.152.28.210. Traffic through the tunnel is mostly traffic to the internet. 213.152.28.210 seems to be the VPN server and is needed to find the end point of the VPN tunnel.

With ip route { add | del } ROUTE you can modify your routing table but first you should clean up your installation to avoid unnecessary settings.

If the VPN connection is down there is no way (route) to the internet. Then you cannot get into the internet without a VPN connection, provided all clients use 192.168.178.35 as its gateway. Its not save if clients use the router 192.168.178.1 as its gateway. This can simply reconfigured on the client. Security then depends on the configuration of the router. If it only passes 213.152.28.210 (public ip addr. of the VPN server) then you are save.

A gateway must reside on the same subnet than the clients. From 192.168.178.0/24 you cannot use 10.16.33.194. It must be 192.168.178.35 with ip forwarding to 10.16.33.194 (routing).

To make a long story short: make sure that all clients use gateway 192.168.178.35, usually done with an option router on the DHCP server, or setting option static routers in /etc/dhcpcd.conf on every client. If you have access to the router then you have to set a filter (firewall rule?) that it only passes ip address 213.152.28.210 to the internet. If you don't have access to it then you only can trust that nobody changes static routers in /etc/dhcpcd.conf.

UPDATES to answer questions from the comments:
The RasPi has no outside public ip address. It is not connected to the internet. It can only be router1 or router2. The RasPi normally sends ip packages to internet through router1. Router1 makes a network address translation (NAT) so everyone outside only sees the routers outside ip address. Returning packages from internet to the RasPi are all send to router1. It knows with NAT that it has them send to the inside RasPi. So everyone outside only sees the routers outside ip address no matter from which inside device the packages are coming.

Traffic through internet is normally not encrypted so everyone can spy your private data. This is the case when using web sites with http://www.... You have to use encrypted connections with https://www.... People will use the RasPi with openvpn if they want to connect to other private devices or networks. Openvpn makes an encrypted tunnel through the unsecure internet so nobody can spy your private data. You self have made the best example for using openvpn the right way by connecting the both private networks 192.168.178.0/24 and 192.168.2.0/24. You use the connection as they where direct connected with an ethernet cable. Nobody can spy your private data going through the vpn tunnel between the networks.

As far as I see it does not make sense in your case to send all internet data from the RasPi through a vpn tunnel to the VPN server in France. There it will leave the vpn tunnel and is send into the internet without encryption. There is no difference if you use router1 direct for internet access.

If you want to obscure your internet activity so the NSA cannot follow your (maybe encrypted) meta data for connections you have to use the Tor network. But this is a complete different approach.