Добрый день. Маюсь с маршрутами, пытаясь построить цепку client - server1 - server2 - web. Первый сервер создает сеть 10.8.0.0, второй 10.0.8.0.
на первом создал таблицу «дабл» в роутах и проложил маршут:
/sbin/ip rule add from 10.8.0.0/24 lookup double pref 20000
iptables (1 server):
-t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to x.x.x.x
-t nat -A POSTROUTING -o tun1 -j MASQUERADE
iptables (2 server):
-t nat -A POSTROUTING -s 10.0.8.0/24 -j SNAT --to y.y.y.y
client
proto udp
remote x.x.x.x 443
dev tun
resolv-retry infinite
nobind
reneg-sec 0
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-128-CBC
tls-client
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
server1 config
port 443
proto udp
dev tun0
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push «dhcp-option DNS z.z.z.z»
push «dhcp-option DNS z.z.z.z»
push «redirect-gateway def1 bypass-dhcp»
crl-verify crl.pem
ca ca.crt
cert server.crt
key server.key
tls-auth tls-auth.key 0
dh dh.pem
auth SHA256
cipher AES-128-CBC
tls-server
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status openvpn.log
verb 3
client-server config
client
proto udp
remote y.y.y.y 443
dev tun1
resolv-retry infinite
nobind
reneg-sec 0
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-128-CBC
route-nopull
script-security 3 system
tls-client
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
server2 config
port 443
proto udp
dev tun0
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.0.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push «dhcp-option DNS z.z.z.z»
push «dhcp-option DNS z.z.z.z»
push «redirect-gateway def1 bypass-dhcp»
crl-verify crl.pem
ca ca.crt
cert server.crt
key server.key
tls-auth tls-auth.key 0
dh dh.pem
auth SHA256
cipher AES-128-CBC
tls-server
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status openvpn.log
verb 3
Пинг с первого сервера на адрес сети 10,0,8,0 проходит
