By andrewellis
Hi I am accessing the internet from home through an openvpn server running on a digital ocean droplet. I also set up a web server on the same droplet.
Now if I try and ssh to the IP address or access the IP address through the VPN the various commands/accesses just hang.
If I turn off the VPN I can access everything just fine.
I appreciate this is probably something to do with routing on the droplet site. I’d be grateful if someone could give me a pointer as to what I need to do to enable access through the vpn and from another machine without the vpn. Thanks Andrew
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Accepted Answer
Hi,
I think your issue may be related to firewall’s NAT settings on VPN server side. I changed my VPN configuration to simulate yours. Now it looks like in the diagram below.
Internet
|
|
------------------ ------------------
| DO Droplet 1 | 10.8.0.0/24 | Home Office |
| (CentOS 8) |_________VPN_______ | ISP's router |
| Internet gateway | \----| Internet gateway |
| VPN Server | \ ------------------
| Front-end Server | \____ |
------------------ | |LAN 192.168.0.0/24
| | |------------
|VPC | | |
|10.106.0.0/20 ------------- |
| | PC 1 | |
----------------- | VPN Client/ | |
| DO Droplet 2 | | VPN Gateway | |
| (Ubuntu 20.4) | | (CentOS 7) | |
| VPN Access | ------------- |
----------------- |
------------- |
| PC 2 | |
| VPN Access |--
| (Windows 10)|
-------------
I can ssh Droplet 1 and get a website served by its from my home office network. VPN channel is up, of course, and I use droplet’s public IP address.
I have installed and configured nftables on Droplet 1. My NAT settings for the traffic outgoing from VPN network to the Internet looks like that:
set masq_interfaces_vpn {
type ifname
elements = { "tun0" }
}
set masq_ips_vpn {
type ipv4_addr
flags interval
elements = { 10.8.0.0/24 }
}
chain outgoing {
type nat hook postrouting priority 120; policy accept;
iifname @masq_interfaces_vpn oifname != @masq_interfaces_vpn masquerade
ip saddr @masq_ips_vpn masquerade
}
I hope it will get you closer to solving your issue. I probably could help you more if I knew more details of your configuration.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.