[nic67]

Hi,

I have trawled the internet and this forum for information and examples for how to configure multiple VPN tunnels where I can develop a source/destination & port ruleset for what traffic to send across a particular tunnel. I have managed to cobble together a startup script based on snippets I found and my basic networking knowledge but cannot get the final configuration to work.

The objective with the basic config below is to

- establish 2 tunnels to HMA servers, one in the US and one in Sweden. This works

- A basic policy where the host 192.168.10.50 will route all traffic across tun0, this does not work.

- An observation is that with the below start up script, the commands

[nic67]

Hi,

Thanks for the pointers, to summarise my findings

1. The syntax error with the missing i in ip was in the post only

2. The cat command to troubleshoot when the router is running is great

3. You were spot on with the single quote characters, it was a copy from a web page and it may have been changed by TextEdit which defaults to .rtf. I moved the whole script to a new editor (TextWrangler) and updated the quotes and the variable is now populated with the correct string.

4. I don't think placing the code in the startup script is an issue, I can confirm that the tunnels come up OK with ifconfig but I will try moving to wanup once I get the routing working

To simplify the troubleshooting, I have tried executing the following part of the code when I have tun0 confirmed to be up using cat > /tmp/temp.sh

[nic67]

Hi,

I have had some success and now have a working basic config

@ebigrad, while I don't dispute your finding about double matches (I don't know this well enough), the statement actually works. The problem with the command as is in the post is that it is fetching the first column in the routing table entry, which is the network and not the gateway.

[nic67]

Hi,

I certainly do not claim that my approach is "right" and I'm sure that as I pick up on this, I will see your points clearer. However, I don't fully understand your comments.

1. What do you mean with the assumption of the matching line ? if the refers to to the way the gateway address is obtained why wouldn't "tun0" always refer to the right gateway adress for that tunnel ? It is extracted from ip route list table main so I don't see how it can be wrong ?

2. What are the OpenVPN variables, I can't find the documentation of $route_vpn_gateway and $dev . Clearly this is a better solution than string matching on the ip table but how do they distinguish between the 2 concurrent tunnels tun0 and tun1 ?

Thanks for your help

Nic