0

All my traffic goes through a subscription VPN service via a gateway. I now want to have a Site-to-Site OpenVPN connection between two synology NAS, with one sitting behind the VPN gateway, the other off-site.

I made a simplified sketch of my Setup:

Sketch

The default route of the NAS should be 192.168.100.1 (VPN Gateway), but this breaks the functionality of the OpenVPN server running on 192.168.10.20, it can be reached, but the out going traffic is apparently routed over the VPN-Gateway.

Is there a way to add some rule that will route all traffic out going from 192.168.10.20:1194 through 192.168.10.1?

The NAS is from Synology, so I can set new iptable rules or ip routes, but my general experience with Synology is to only make minimally invasive change to the config or stuff will break.

Edit 18.07.2022:

Based on @Tom Yan and https://www.thomas-krenn.com/de/wiki/Zwei_Default_Gateways_in_einem_System (german) I came up with this on boot script:

#!/bin/bash

echo "1 gateway-table" >> /etc/iproute2/rt_tables
ip route add 192.168.10.0/24 dev eth1 src 192.168.10.20 table gateway-table
ip route add default via 192.168.10.1 dev eth1 table gateway-table
ip rule add from 192.168.10.20/32 table gateway-table
ip rule add to 192.168.10.20/32 table gateway-table

exit 0

Unfortnatly this isn't working either.

Nils
  • 101
  • 2
  • Check out `ip rule`. – Tom Yan Jul 18 '22 at 02:11
  • @TomYan I tried your hint, but didn't get it working, what am I missing? – Nils Jul 18 '22 at 07:01
  • 1
    Instead of `from 192.168.10.20/32`, I'd probably try `iif lo ipproto udp sport 1194` (or omit `ipproto udp` if your server does both). I can't tell for sure if it'd still be affected by "multihome issue" though. Check out the `multihome` option of OpenVPN maybe. – Tom Yan Jul 18 '22 at 08:42

1 Answers1

0

As @Tom Yan suggested adding multihome to the server config worked!

The Synology OpenVPN server config can be edit with:

sudo vi /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf

just add multihome to the end of the file and reboot the device. Afterwards you can set different interfaces for the default gateway and the listing interface of the OpenVPN server.

There is no need for any additional routes or rules.

Nils
  • 101
  • 2