I have two sites. Site 1 has a router with a public IP A.B.C.D
as well as a private range 192.168.13.0/24
. The router also occupies the private IP 192.168.13.1
. Site 2 is a single host with a public IP X.Y.Z.W
.
The problem is that site 2 is behind a firewall not under my control. As a result, site 2 can access site 1 at A.B.C.D
but site 1 cannot access site 2 directly.
To work around the limitation, I configured site 2 to connect to site 1's router over an OpenVPN tunnel, and using iproute2
source policy routing to redirect traffic from the private range (except the router itself) to X.Y.Z.W
to go through the tunnel. For example, I have to use the following command on the router at site 1
ip rule add from 192.168.13.32/27 to X.Y.Z.W lookup vpn
to redirect traffic from the block 192.168.13.32/27
to X.Y.Z.W
to consult the routing table vpn
in which the default gate is the OpenVPN endpoint. I have to use source policy routing to exclude the router (which is at 192.168.13.1
), otherwise the VPN traffic would not be routed back to X.Y.Z.W
correctly.
So far everything is working fine, but I'm not very happy with the source policy routing because it requires me to change the ip rule
every time private range 192.168.13.0/24
is changed, or more sub-blocks is added.
I'm wondering if there is any easier way to make X.Y.Z.W
available to site 1's private range without using source policy routing?