How do I share one VM's VPN tunnel with another VM?

[halpoins]

Bottom line: I am connecting to the internet via VPN on UDP/53 in order to deal with a captive wifi portal, something which is possible in a desktop environment but not a headless server environment. So I have two VMs: Ubuntu Desktop and Ubuntu Server. Desktop can connect to the web using tun0, but Server can't.

I have tried for weeks to set up the VPN in my router so that the individual clients don't have to bother with it. I have tried configuring openvpn on the server, but the VPN provider has explicitly stated they don't support UDP/53 on router or CLI environments.

Is there a way to bridge the two VMs so that the Server can "borrow" the downstream internet connection that the Desktop is creating through its VPN interface? Even if it's slow, I don't care. A trickle is better than nothing.

 

[Richard]

AFAIU you use a VPN method which works in a desktop environment only but you want to use accessing it from a server without desktop environment too.
Since I don't know your network topology in detail I cannot be sure if one of the following possibilities is convenient for you, however:
- use the Desktop VM as (maybe NAT) router, define for this an additional bridge (without any hardware, just internal) and connect an additional NIC in each VM to it. Then route connections to VPN at the headless VM via Desktop VM.
- similar to above but instead of routing use a tap instead of a tun deive and create a bridge inside the Desktop VM, then the headless one has direct access to VPN network (works only if the VPN protocol allows bridging, tap and connecting more endpoints).

 

[halpoins]

AFAIU you use a VPN method which works in a desktop environment only but you want to use accessing it from a server without desktop environment too.
Since I don't know your network topology in detail I cannot be sure if one of the following possibilities is convenient for you, however:
- use the Desktop VM as (maybe NAT) router, define for this an additional bridge (without any hardware, just internal) and connect an additional NIC in each VM to it. Then route connections to VPN at the headless VM via Desktop VM.
- similar to above but instead of routing use a tap instead of a tun deive and create a bridge inside the Desktop VM, then the headless one has direct access to VPN network (works only if the VPN protocol allows bridging, tap and connecting more endpoints).

You have understood correctly. I have a simple network of a physical router and the Proxmox host, which has one Network Device enp0s31f6 and one Linux Bridge vmbr0. If I follow you correctly, I'll create a new Linux Bridge on my PVE host which will become available to the hosts to add as a network device.

But when you say "route connections to VPN" I don't know how to do that off the top of my head, I'd have to start with googling that phrase. Is it simply writing a new block in /etc/network/interfaces? Not all of my VMs have that file by default, so I'm not sure where they are getting their network interface instructions from.

Your second suggestion is also outside of my expertise but I'm willing to attempt anything. Do you happen to know of a good proxmox wiki page or other resource that would guide me through that?

 

[Richard]

But when you say "route connections to VPN" I don't know how to do that off the top of my head, I'd have to start with googling that phrase. Is it simply writing a new block in /etc/network/interfaces? Not all of my VMs have that file by default, so I'm not sure where they are getting their network interface instructions from.

At PVE host:
- Create a new bridge (without assigning any NIC to it) with a new subnet which exists only locally, choose e.g. 192.168.100.100/24 as address and specify 192.168.100.1 a gateway (yes, /etc/network/interfaces will contain that configuration, but nothing to edit there when you use Proxmox VE WEG-GUI)
- Create new interfaces for both Ubuntu Desktop and Ubuntu server VM which are assigned to the new bridge

At Ubuntu Desktop VM:
- assign address 192.168.100.1 to the new NIC
- allow routing by

echo 1 > /proc/sys/net/ipv4/ip_forward

- define NAT by

iptables -t NAT -A POSTROUTING -j MASQUERADE

Attention! Desktop environment may overwrite network settings done by command line. Check the documentation.

At Ubuntu Server VM:
- assign address 192.168.100.101 to the new NIC
- set 192.168.100.1 as default gateway

Your second suggestion is also outside of my expertise but I'm willing to attempt anything. Do you happen to know of a good proxmox wiki page or other resource that would guide me through that?

At the first step it's not a question of Proxmox - mainly depends on the VPN implementation you use (which I do not know) if it allows to specify tap devices as virtual NICs - these devices you can bridge to a "real" (which is in case of a VM also a virtual one, but looks for OS like a physical one) NIC then. Or in other words: before continuing with that idea clarify if you can create VPN tap devices.

 

[halpoins]

At PVE host:
- Create a new bridge (without assigning any NIC to it) with a new subnet which exists only locally, choose e.g. 192.168.100.100/24 as address and specify 192.168.100.1 a gateway (yes, /etc/network/interfaces will contain that configuration, but nothing to edit there when you use Proxmox VE WEG-GUI)

At this step, I got the error "Default gateway already exists on interface 'vmbr0'". vmbr0 is at 192.168.1.169/24 with gateway 192.168.1.1, I guess only one gateway can be defined at a time? I left the gateway for vmbr1 blank for now and moved on.

- Create new interfaces for both Ubuntu Desktop and Ubuntu server VM which are assigned to the new bridge

At Ubuntu Desktop VM:
- assign address 192.168.100.1 to the new NIC

I did this with

ifconfig ens19:0 192.168.100.1 up

not sure if that is right but the address can be pinged afterward.

- allow routing by

echo 1 > /proc/sys/net/ipv4/ip_forward

- define NAT by

iptables -t NAT -A POSTROUTING -j MASQUERADE

The first line was successful but not the second, because the table NAT doesn't exist.

 

[Richard]

At this step, I got the error "Default gateway already exists on interface 'vmbr0'". vmbr0 is at 192.168.1.169/24 with gateway 192.168.1.1, I guess only one gateway can be defined at a time? I left the gateway for vmbr1 blank for now and moved on.

Depends on what you want to use as gateway from inside the host - and yes: only one default gateway can exist, otherwise it would not make any sense.

I did this with

ifconfig ens19:0 192.168.100.1 up

not sure if that is right but the address can be pinged afterward.

It's correct, but note that the setting is not permanent (disappear latest after reboot but may also be overwritten by a parallel existing network management service.

The first line was successful but not the second, because the table NAT doesn't exist.

"nat" must be written in small letters, sorry for the typo.