client device

1. Set metaconstants described above in your shell's environment.

2. Check basic networking with network_test.sh . If needed,

   • restore original routes with restore_original_routes.sh
   • restore original interfaces/links with restore_original_links.sh
   • restore original DNS/resolvconf with restore_original_DNS.sh

3. Get INITIAL_PUBLIC_IPN with get_public_IP_n.sh

4. Ensure that local OpenVPN client is !running, with kill_OpenVPN_client.sh

5. Check that there is no firewall running on the client device with sudo iptables -L

6. Get information about local/non-public addresses (e.g., LOCAL_IPN) and routes with get_local_routes.sh

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

0: default via 192.168.1.1 dev eth0 proto static
1: 169.254.0.0/16 dev eth0 scope link metric 1000
2: 192.168.1.0/24 dev eth0 proto kernel scope link src LOCAL_IPN

jumpbox

1. Ensure remote OpenVPN server is running on the jumpbox. This can be done from the client device with `check_OpenVPN_server.sh`_.

2. Check the firewall on the jumpbox: ssh to it and run sudo iptables -L

3. Check routes on the jumpbox. This can be done from the client device with (TODO: script to ensure properties load):

   ssh ${MYNODE_USER_NAME}@${MYNODE_IPV4} 'ip route show' 2> /dev/null
   # see example routes below
   

Chain INPUT (policy ACCEPT)
target     prot opt source                  destination
fail2ban-ssh  tcp  --  anywhere             anywhere      multiport dports ssh
ACCEPT     all  --  anywhere                anywhere
ACCEPT     all  --  anywhere                anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source                  destination
ACCEPT     all  --  anywhere                anywhere      state RELATED,ESTABLISHED
ACCEPT     all  --  OPENVPN_DOMAIN_IPN/24   anywhere
REJECT     all  --  anywhere                anywhere      reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere                anywhere
ACCEPT     all  --  anywhere                anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source                  destination

Chain fail2ban-ssh (1 references)
target     prot opt source                  destination
DROP       all  -- fixed-189-104-103.iusacell.net  anywhere
RETURN     all  --  anywhere                anywhere

0: default via JUMPBOX_GATEWAY_IPN dev eth0
1: OPENVPN_DOMAIN_IPN/24 via 10.8.0.2 dev tun0
2: 10.8.0.2 dev tun0  proto kernel  scope link  src OPENVPN_GATEWAY_IPN
3: JUMPBOX_DOMAIN_IPN/24 dev eth0  proto kernel  scope link  src JUMPBOX_PUBLIC_IPN

routes

After starting the OpenVPN client on the client device, ip route shows the following routes on the client device (IP# parameterization and route numbering added for clarity):

0: 0.0.0.0/1 via OPENVPN_ENDPT_IPN dev tun0
1: default via 192.168.1.1 dev eth0  proto static
2: OPENVPN_GATEWAY_IPN via OPENVPN_ENDPT_IPN dev tun0
3: OPENVPN_ENDPT_IPN dev tun0  proto kernel  scope link  src OPENVPN_SRCPT_IPN
4: 128.0.0.0/1 via OPENVPN_ENDPT_IPN dev tun0
5: 169.254.0.0/16 dev eth0  scope link  metric 1000
6: JUMPBOX_PUBLIC_IPN via 192.168.1.1 dev eth0
7: 192.168.1.0/24 dev eth0  proto kernel  scope link  src LOCAL_IPN

where

• JUMPBOX_PUBLIC_IPN is the jumpbox's public IP#, as shown by (e.g.) get_public_IP_n.sh
• LOCAL_IPN is the client device's LAN IP# , as shown by (e.g.) ip addr show dev eth0 | fgrep -e 'inet '
• OPENVPN_ENDPT_IPN is "the server side of the pipe" (currently 10.8.0.5, which has not been observed to change)
• OPENVPN_GATEWAY_IPN is the OpenVPN's "gateway IP#" (currently 10.8.0.1, which has not been observed to change)
• OPENVPN_SRCPT_IPN is "the client side of the pipe" (currently 10.8.0.6, which has not been observed to change)

routes

After starting the F5VPN client on the client device, ip route shows the following routes on the client device (IP# parameterization and route numbering added for clarity):

0: 0.0.0.0/1 via F5VPN_ENDPT_IPN dev ppp0  proto none  metric 1
1: default via 192.168.1.1 dev eth0  proto static
2: F5VPN_GATEWAY_IPN dev ppp0  proto kernel  scope link  src F5VPN_ENDPT_IPN
3: 128.0.0.0/1 via F5VPN_ENDPT_IPN dev ppp0  proto none  metric 1
4: F5VPN_PUBLIC_IPN via OPENVPN_ENDPT_IPN dev tun0  proto none  metric 1

where

• F5VPN_PUBLIC_IPN seems to be the public IP# of whatever the client device has now connected to (though that is merely my guess). It seems to change with every connection.
• LOCAL_IPN is the client device's LAN IP# , as shown by (e.g.) ip addr show dev eth0 | fgrep -e 'inet '
• F5VPN_ENDPT_IPN seems to be "the server side of the pipe" to which the the client device has now connected (though that is merely my guess). It also seems to change with every connection, but always seems to begin with 10.144..
• F5VPN_GATEWAY_IPN seems to be the "gateway IP#" for the F5VPN (currently 10.144.0.1, which has not been observed to change)
• OPENVPN_ENDPT_IPN is "the server side" of the OpenVPN (currently 10.8.0.5, which has not been observed to change)

problem

The above routeset is broken, in that it does not appropriately route traffic from the client device through the {jumpbox, OpenVPN server}. Hence network_test.sh shows the following problems:

1. ping:

   > network_test.sh: ping -c 4 162.220.62.158
   > PING 162.220.62.158 (162.220.62.158) 56(84) bytes of data.
   >
   > --- 162.220.62.158 ping statistics ---
   > 4 packets transmitted, 0 received, 100% packet loss, time 3024ms
   

2. DNS:

   > network_test.sh: nslookup api.hostip.info
   > ;; connection timed out; no servers could be reached
   

Note that

• 162.220.62.158 and api.hostip.info are defined public properties
• 162.220.62.158 is the IP# corresponding to api.hostip.info (and should be returned when DNS is working)

client device

1. If desired, interrogate post-F5VPN-activation state in more detail
2. Get information about F5VPN-related addresses and routes with get_F5VPN_routes.sh
3. Delete F5VPN-misconfigured routes with delete_current_routes.sh
4. Set desired routes on F5VPN with set_F5VPN_routes.sh

set_F5VPN_routes.sh currently attempts to set the following routes on the client device:

192.168.1.0/24 dev eth0  proto kernel  scope link  src LOCAL_IPN
0.0.0.0/1 via F5VPN_ENDPT_IPN dev ppp0  proto none  metric 1
default via 192.168.1.1 dev eth0  proto static
F5VPN_GATEWAY_IPN dev ppp0  proto kernel  scope link  src F5VPN_ENDPT_IPN
128.0.0.0/1 via F5VPN_ENDPT_IPN dev ppp0  proto none  metric 1
JUMPBOX_PUBLIC_IPN via 192.168.1.1 dev eth0
F5VPN_PUBLIC_IPN via OPENVPN_ENDPT_IPN dev tun0  proto none  metric 1
F5VPN_GATEWAY_IPN via OPENVPN_GATEWAY_IPN dev tun0

using the following identities:

• LOCAL_IPN is the client device's original/LAN IP#
• JUMPBOX_PUBLIC_IPN is (currently, but this should be stable) the jumpbox's public IP#
• OPENVPN_ENDPT_IPN is the OpenVPN's "endpoint IP#" (currently 10.8.0.5 and has not been observed to change)
• OPENVPN_GATEWAY_IPN is the OPENVPN's gateway IP# (i.e., ${OPENVPN_ENDPT_IPN%.*}.1)
• F5VPN_ENDPT_IPN is the F5VPN's "endpoint IP#" (10.144.14.186 in this example--may change between connections?)
• F5VPN_GATEWAY_IPN is the F5VPN's gateway IP# (i.e., ${F5VPN_ENDPT_IPN%.*}.1)
• F5VPN_PUBLIC_IPN is the F5VPN server's public IP# (which is known to change on each connection)

(Note also that ip route add will not set routes containing proto none, so I strip that text wherever it occurs.)