On Thu, Aug 22, 2013 at 04:16:13PM -0600, Bob Proulx wrote: > Gregory Nowak wrote: > > The public address assigned to the laptop would actualy be > > configured on the VPS, > > Hmm... No. Sorry. Doesn't make sense. The public address assigned > to the laptop would probably be yet another private address behind a > NAT somewhere.
Ok, some confusion here it seems. Both you and I are right in that the laptop's public address is assigned to the VPS, and is also in reality yet another private address behind a NAT somewhere like you said. I'll explain below, since I do in fact have this going as I mentioned in my latest post to the VPS crashing thread. I wrote> > > and the VPS would be doing NAT between the private address of the > > laptop, and the public address assigned to the laptop, but > > configured on the VPS itself. > > If you understand this then please keep going. But the description > doesn't make sense to me. I read carefully what I wrote above, and I can't think of a way to make it any clearer. Let me explain how I have this going. On the VPS, eth0:0 is configured with the laptop's public address. Just to be clear, the public address here is the one machines on the internet send traffic to, and the one which traffic from the laptop is coming from as far as the rest of the internet is concerned. In addition to this, I have iptables rules using the nat table, which take traffic which has the laptop's public address as destination, and do DNAT on it, changing the destination address to be the laptop's private address. I also have a rule doing the reverse. This rule takes packets with the laptop's private address as source, and does SNAT on them, changing the source address to be the laptop's public address, and sends them out eth0. Again, I do have this functioning. So, whereas before I was writing this based on theory, I can assure you it does actually work in practice. I wrote > > > In a nutshell, the laptop would have a private address assigned to > > it, but all traffic to and from the laptop would actually be using > > the public address assigned to it, which itself would be configured > > on the VPS. > > One of the often hit traps is that people often think, start up DHCP > on the mobile client. Then start up the VPN. Then change the > routing so that 100% of all traffic goes through the VPN. Sounds > great. Except that it can't work. The mobile device needs to > transport the VPN traffic over the non-VPN routed network. And the > mobile client needs to have DHCP available which will periodically > need to interact with the local dhcp server and renew its leases. Correct. The notion of routing all traffic through the VPN is a misnomer. It seems you're taking what I said to literally. > > Routing all client traffic (including web-traffic) through the VPN > http://openvpn.net/index.php/open-source/documentation/howto.html#redirect > > I would consider setting up proxy arp on the server. Set it up to > proxy for the IP address but do not configure it to own the IP > address. Here is a reference. > > Proxy ARP > http://shorewall.net/ProxyARP.htm > Ok, proxy arp as I understand it requires that network devices have a MAC address. Since I didn't assign a MAC address to the tun0 device in the openvpn config, it wouldn't work. Yes, I could assign the tun device a MAC address if I wanted to, I know. The other part of this is that proxying arp just tells the rest of the network on what given interface a particular machine can be reached. I think Zenaan and I have established sufficiently in this thread that I can't simply give the laptop side a public address through openvpn directly, and expect it to just work. So that still leaves the laptop with using a private address to go through the openvpn gateway. So, I still need NAT, and that's how I have things working now. > I read back but didn't see anywhere that you said what services you > wanted. "All" I suppose. I did indicate that I didn't want the VPS to do any firewalling. Zenaan's response to this was that for it to work, the VPS will need to do firewalling. This is correct of course. Perhaps if I would have stated I don't want the VPS to do any port blocking for the laptop's public address, it would have been more clear. Hope this makes more sense now. Greg -- web site: http://www.gregn..net gpg public key: http://www.gregn..net/pubkey.asc skype: gregn1 (authorization required, add me to your contacts list first) -- Free domains: http://www.eu.org/ or mail dns-mana...@eu.org -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20130823033322.ga10...@gregn.net
