|Version 1 (modified by admin, 19 months ago)|
* The z2-6 ganeti host located at OVH has IP 184.108.40.206 * The z2-9 ganeti host located at tetaneutral runs the VM 10.10.1.66 * There is an openvpn tunnel between z2-6 and z2-9 (the tunnel already exists) * The goal is route all incoming / outgoing traffic to / from 10.10.1.66 on 220.127.116.11 and never use the z2-9 default route * On z2-6
ACCEPT net loc:10.10.1.66 tcp - - 18.104.22.168
22.214.171.124 eth0:240 10.10.1.66 Yes
* On z2-9
remote z2-61.pokersource.info proto udp6 dev tun6 port 6009 management 127.0.0.1 9506 ifconfig 10.1.9.6 10.1.6.9 secret /etc/openvpn/keys/shared.key comp-lzo keepalive 10 60 ping-timer-rem persist-tun persist-key script-security 2 up ./tun6-up
Note the script-security 2 and up ./tun6-up at the end, which are the two lines added to the pre-existing file.
#!/bin/bash ip route add default via 10.1.6.9 dev tun6 table 6 # 10.10.1.66 default route is z2-6 which is reachable thru tun6 ip rule delete from 10.10.1.66 table 6 > /dev/null || true ip rule add from 10.10.1.66 table 6
The ip route add creates a table 6 routing table in which the default route is the tunel just established. The numbering uses the same numbers as the remote ganeti host. When the tunel goes down the route will be automatically removed. The ip rule says that all outgoing traffic originating from 10.10.1.66 must be routed using the routing table 6 as defined in the previous line. It needs to be deleted, if any, because it won't be automatically removed when the tunnel goes down.
- Ideas & problems
ip route add default via 10.1.6.9 dev tun6 table 6
so that it does not contain 10.1.6.9.
- What if 10.10.1.66 wants to access 10.10.1.200 which is on z2-9 ? It will go thru z2-6 which is fairly useless.