0

I'm not really sure what my problem/request is called, but this is my situation:

I run an OpenVPN Access Server server. It's configured to operate on layer 3. The private subnet it can operate on is defined as 10.129.0.0/16. Its own IP is 10.129.1.1 (interface=eth1). When connected to the VPN, I can SSH/connect to every server in the 10.129.*.* range -- for example, 10.129.20.20. As long as the firewall on 10.129.20.20 permits access originating from 10.129.1.1, access is granted.

Now, there's a set of servers I want to connect to, with requests originating from my VPN its public facing interface (eth0). When connecting to 188.188.188.188, I'd like my VPN server to route its traffic through its other interface, so it seems like the request is originating from the VPN server itself. That way, the external server can open its firewall to only my VPN its public IP.

As per the answer below, I reckon I'm looking for a jump host or bastion server.

Improve this question
5
  • I posted an answer below, but if you edit your question to supply more details about your network topology, how the servers are connected to the VPN gateway (or not), etc. you may receive more answers which are tailored to the details of your setup.
    – Jeff Wheeler
    Jul 23, 2020 at 18:41
  • @JeffWheeler I've done so, hopefully the details convey what I'm trying to say/learn.
    – Mave
    Jul 23, 2020 at 20:49
  • Unfortunately, questions about hosts/servers are off-topic here. You could try to ask this question on Server Fault for a business network.
    – Ron Maupin ♦
    Jul 23, 2020 at 21:05
  • @Ron Maupin I tried to state my question without asking specific advice for my setup. I just want to learn about VPN's, how they're commonly used, what kind of 'advanced' setups there are, NAT/routing/bastions/jump hosts. Perhaps this is still not the best spot, yeah, might not be.
    – Mave
    Jul 23, 2020 at 21:47
  • "As per the answer below, I reckon I'm looking for a jump host or bastion server." That is a host/server question, and it also seems to be looking for a product or resource recommendation, which is also explicitly off-topic here. We can help with a network and on-topic network devices (enterprise-grade routers, switches, etc.), but Server Fault deals with hosts/servers and those networks.
    – Ron Maupin ♦
    Jul 23, 2020 at 22:05

1 Answer 1

Reset to default
1

Bastion or jump host are common names for this, yes.

You will need the target servers to also belong to your VPN. The scope of this question can get big quickly. For this answer, I'll assume your VPN is just one router/firewall to which VPN clients connect. I'll also assume that VPN router is on the same LAN as your servers. You can do the following to reach those servers' public IPs, from your VPN clients on their private IPs:

  • Ensure servers route 10.129.0.0/16 to the VPN router/firewall (or that the default gateway on the LAN does this)
  • Add routes on your desktop VPN clients for the servers' public IP addresses, for example, 203.0.113.0/24 to traverse the VPN
  • Ensure any access-lists or zone firewall rules allow the traffic

As you can see, RFC1918 addresses (like 10.129.x.x) are capable of communicating with public IP addresses, so long as you manage all the involved routers/firewalls/etc. This is really common in enterprise networking.

Improve this answer
2
  • Cool! My VPN is actually an OpenVPN instance in my own control. You say, 'add routes on your VPN clients', but is there a way to leave that to the VPN server itself? Is that a jump host / bastion?
    – Mave
    Jul 23, 2020 at 20:10
  • It depends -- if you're routing all traffic from your desktop clients over the OpenVPN, then yes, the VPN server can do this. Otherwise, you need to configure OpenVPN to install the routes you want into the clients' routing tables when they connect to the VPN.
    – Jeff Wheeler
    Jul 23, 2020 at 21:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.