Gentoo Archives: gentoo-user

From: "Michael J. Hill" <mjhill@××××××××××.com>
To: gentoo-user@l.g.o
Subject: [gentoo-user] PPP Tunnel using iproute2/tun interface
Date: Wed, 21 Mar 2012 02:07:38
1 Hello,
3 In testing, I have gotten this setup to work by manually completing the necessary steps; however, I am now looking to have everything completed automatically so as to ensure my setup persists over a reboot.
5 Firstly, an outline of what I am doing:
6 * I have a Gentoo VM running at home, functioning as my firewall/router, which works perfectly fine.
7 * Said VM has established an IPSEC tunnel to a dedicated server using OpenSWAN. This also works perfectly fine.
8 * A tun0 interface is created on both devices, setting up an IPIP PPP tunnel that sits on top of the IPSEC tunnel.
9 * Firewall and Routing rules are in place to perform policy-based routing over this tun0 interface. This again, works perfectly fine.
11 For the rest, the following configuration is worth noting:
12 * The dedicated server is running CentOS 6, not that this is of necessary import for this configuration.
13 * resides on the dedicated server.
14 * is the management IP of my Gentoo VM, and serves as its identity as well.
15 * is the network utilized for the tunnel, with on the dedicated server, and on the Gentoo VM.
17 In effect, the first thing I need to do, is automate the IPIP PPP tunnel setup so that the device can persist over a reboot. I can create it manually right now, no problem, with the following command strings:
18 # ip tunnel add tun0 mode ipip remote local
19 # ip addr add dev tun0
20 # ip link set tun0 mtu 1500
21 # i p link set tun0 up
23 This all works perfectly fine, and tun0 is created after running the first command. Now I need this to persist a reboot. I wanted to handle this through OpenRC, since I can then do dependency resolution, and make sure the tunnel comes up only if the IPSEC tunnel is up and running. That being said, I added the following to /etc/conf.d/net:
24 link_tun0="ipsec0"
25 config_tun0=" netmask brd"
26 dns_servers_tun0=""
27 routes_tun0=(
28 " via"
29 "default via table ipsec"
30 )
31 mtu_tun0="1500"
32 iptunnel_tun0_remote=""
33 iptunnel_tun0_local=""
34 iptunnel_tun0_mode="ipip remote ${iptunnel_tun0_remote} local ${iptunnel_tun0_local} dev ${link_tun0}"
35 rc_net_tun0_need="ipsec"
36 preup() {
37 # If the link does not exist, return now, it's a tunnel!
38 ip link show dev ${IFACE} 2>/dev/null || return 0
39 }
41 Now, the configuration does reflect an additional item not in my original setup, which links tun0 to the ipsec0 interface. I've tested with and without this, and it doesn't work. Attempting to bring up the interface using rc-service results in the following error:
42 Cannot find device "tun0"
43 * ERROR: interface tun0 does not exist
44 * Ensure that you have loaded the correct kernel module for your hardware
45 * ERROR: net.tun0 failed to start
47 I could easily script all this out, and probably call it through rc.local, but I'd rather be able to utilize the dependency resolution to make sure all the necessary components are up.
49 Any insights on getting it to behave?
51 Michael Hill


Subject Author
Re: [gentoo-user] PPP Tunnel using iproute2/tun interface Mick <michaelkintzios@×××××.com>