VPN via the TUN/TAP device - Revision history

Vvs: Reverted edits by 37.201.195.46 (talk) to last revision by Sergey Bronnikov

2017-10-31T09:28:16Z

Reverted edits by 37.201.195.46 (talk) to last revision by Sergey Bronnikov

37.201.195.46 at 03:13, 29 October 2017

2017-10-29T03:13:54Z

Sergey Bronnikov: Marked this version for translation

2015-12-31T10:39:29Z

Marked this version for translation

Sergey Bronnikov: add 'translate' tags

2015-12-31T10:39:05Z

add 'translate' tags

Kir: /* Troubleshooting */ fix solution

2015-05-08T20:53:34Z

‎Troubleshooting: fix solution

Kir: /* External links */ fix kb link

2015-05-08T20:50:52Z

‎External links: fix kb link

Sergey Bronnikov: Parallels -> Odin

2015-05-08T11:42:32Z

Parallels -> Odin

Sergey Bronnikov: Update links to KB articles

2015-03-27T14:25:31Z

Update links to KB articles

Kir: fix vzctl commands

2015-02-18T19:15:09Z

fix vzctl commands

Kir: --devnodes should be enough

2015-02-18T19:13:45Z

--devnodes should be enough

@@ Line 4: / Line 4: @@
 == Kernel TUN/TAP support == <!--T:2-->
-OpenVZ(Virtual Server) supports VPN inside a container via kernel TUN/TAP module and device.
+OpenVZ supports VPN inside a container via kernel TUN/TAP module and device.
 To allow container #101 to use the TUN/TAP device the following should be done:

@@ Line 4: / Line 4: @@
 == Kernel TUN/TAP support == <!--T:2-->
-OpenVZ supports VPN inside a container via kernel TUN/TAP module and device.
+OpenVZ(Virtual Server) supports VPN inside a container via kernel TUN/TAP module and device.
 To allow container #101 to use the TUN/TAP device the following should be done:

@@ Line 1: / Line 1: @@
 <translate>
 This article describes how to use VPN via the TUN/TAP device inside a [[container]].
-== Kernel TUN/TAP support ==
+== Kernel TUN/TAP support == <!--T:2-->
 OpenVZ supports VPN inside a container via kernel TUN/TAP module and device.
 To allow container #101 to use the TUN/TAP device the following should be done:
 Make sure the '''tun''' module has been already loaded on the [[hardware node]]:
   lsmod | grep tun
 If it is not there, use the following command to load '''tun''' module:
   modprobe tun
 To make sure that '''tun''' module will be automatically loaded on every reboot you can also add it or into <code>/etc/modules.conf</code> (on RHEL see <code>/etc/sysconfig/modules/</code> directory).
-== Granting container an access to TUN/TAP ==
+== Granting container an access to TUN/TAP == <!--T:6-->
 Allow your container to use the tun/tap device by running the following commands on the host node:
-  CTID=101
+  <!--T:8-->
   vzctl set $CTID --devnodes net/tun:rw --capability net_admin:on --save
-== Configuring VPN inside container ==
+== Configuring VPN inside container == <!--T:9-->
 After the configuration steps above are done it is possible to use VPN software working with TUN/TAP inside
 container just like on a usual standalone Linux box.
 The following software can be used for VPN with TUN/TAP:
 * Tinc (http://tinc-vpn.org)
@@ Line 30: / Line 37: @@
 * Virtual TUNnel (http://vtun.sourceforge.net)
-== Reaching hosts behind VPN container ==
+== Reaching hosts behind VPN container == <!--T:11-->
 In order to reach hosts behind VPN container you must configure it to use a VETH interface instead a VENET one, at least with an OpenVPN server.
 With a VENET interface you will only reach the VPN container.
 To use a VETH device follow [[Veth]] article.
 If you insist on using a VENET interface and need to reach hosts behind the OpenVPN VE then you can use source NAT. You need to mangle source packets so that they appear to originate from the OpenVPN server VE.
-== Tinc problems ==
+== Tinc problems == <!--T:15-->
 Using the default venet0:0 interface on the container, tinc seems to have problems as it complains the port 655 is already used on 0.0.0.0.
 Netstat shows that the port 655 is available:
 <pre>
 root@132 / [3]# netstat -l
@@ Line 59: / Line 72: @@
 </pre>
 Starting the Tincd daemon where it complains that port 655 is not available:
 <pre>
 root@132 / [4]# tincd -n myvpn
@@ Line 78: / Line 93: @@
 </pre>
 An echo to Bindv6only (see [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440150 discussion here]) seems to resolve the problem:
 <pre>
 root@132 / [12]# echo 1 > /proc/sys/net/ipv6/bindv6only
 </pre>
 Or put in your /etc/sysctl.conf file:
 <pre>
 net.ipv6.bindv6only = 1
 </pre>
 Then apply the changes with:
 <pre>
 root@132 / [14]# sysctl -p
 </pre>
-== The tunctl problem ==
+== The tunctl problem == <!--T:27-->
 Unfortunately, you are limited to [http://forum.openvz.org/index.php?t=msg&th=4280&goto=22066&#msg_22066 non-persistent tunnels inside the VEs]:
 <pre>
 # tunctl
@@ Line 104: / Line 126: @@
 </pre>
 Get a patched tunctl [https://github.com/xl0/uml-utilities here], and run it with the -n option. It will create a non-persistent tun device and sleep instead of terminating, to keep the device from deletion. To remove the tunnel, kill the tunctl process.
-== Troubleshooting ==
+== Troubleshooting == <!--T:30-->
 If NAT is needed within the VE, this error will occur on attempts to use NAT:
-  # iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
+  <!--T:31-->
   iptables v1.4.3.2: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
   Perhaps iptables or your kernel needs to be upgraded.
 Solution:
 * use recent kernel
@@ Line 119: / Line 144: @@
 : <code>vzctl set $CTID --netfilter full --save</code>
-== External links ==
+== External links == <!--T:33-->
 * [http://vtun.sourceforge.net Virtual TUNnel]
 * [http://openvpn.net OpenVPN]

@@ Line 1: / Line 1: @@
 This article describes how to use VPN via the TUN/TAP device inside a [[container]].
@@ Line 124: / Line 125: @@
 * [http://openvpn.net/index.php/access-server/howto-openvpn-as/186-how-to-run-access-server-on-a-vps-container.html How to run OpenVPN Access Server in OpenVZ]
 * [http://kb.odin.com/en/696 Odin KB #696: Is VPN via the TUN/TAP device supported inside a Container?]
 [[Category: HOWTO]]
 [[Category: Networking]]

@@ Line 113: / Line 113: @@
   Perhaps iptables or your kernel needs to be upgraded.
-The solution is given here:
+Solution:
+* use recent kernel
- http://kb.sp.parallels.com/en/5228
+* enable NAT inside CT:
+: <code>vzctl set $CTID --netfilter full --save</code>
 == External links ==

@@ Line 128: / Line 128: @@
 * [http://tinc-vpn.org Tinc]
 * [http://openvpn.net/index.php/access-server/howto-openvpn-as/186-how-to-run-access-server-on-a-vps-container.html How to run OpenVPN Access Server in OpenVZ]
-* [http://kb.sp.parallels.com/en/696 Parallels KB#696: Is VPN via the TUN/TAP device supported inside a Container?]
+* [http://kb.sp.parallels.com/en/696 Odin KB#696: Is VPN via the TUN/TAP device supported inside a Container?]
 [[Category: HOWTO]]
 [[Category: Networking]]