>>1653452
Схема

Схема:

server-1 и clent-1 = один сервер

user -> server-1 -> client-1 -> server-2 -> inet(ip 2.2.2.2)

Итого должно быть user -> inet(ip 2.2.2.2)
-------------------

Server-1
================
#server-1.conf

port 443
local 1.1.1.1
proto tcp
dev tun1
server 10.8.0.0 255.255.255.0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/tls.key 0
cipher AES-256-CBC
log svpn.log
verb 3
max-clients 30
keepalive 10 120
tls-server
comp-lzo
persist-key
persist-tun
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
fast-io
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
tun-mtu 1500

#client-1.conf

dev tun0
remote 2.2.2.2
port 444
proto tcp-client
ifconfig 192.168.1.2 192.168.1.1
tls-client
daemon
script-security 3 system
ns-cert-type server
ca /etc/openvpn/c0/ca.crt
cert /etc/openvpn/c0/c0.crt
key /etc/openvpn/c0/c0.key
dh /etc/openvpn/c0/dh2048.pem
tls-auth /etc/openvpn/c0/tls.key 1
cipher AES-256-CBC
persist-key
persist-tun
log kaka.log
verb 3
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh
fast-io
tun-mtu 1500

#cat up.sh

#!/bin/bash
echo "101 ip_1" >>/etc/iproute2/rt_tables
IP="/sbin/ip"
$IP rule add to 192.168.1.2 table ip_1
$IP rule add from 192.168.1.2 table ip_1
$IP route add default via 192.168.1.1 table ip_1

#cat down.sh

#!/bin/bash
IP=`which ip`
$IP route del default via 192.168.1.1 table ip_1
$IP rule del table ip_1
$IP rule del table ip_1
sed -i '/101 ip_1/d' /etc/iproute2/rt_tables

#iptables
iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 5012 packets, 349K bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 143 packets, 12365 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 188 packets, 15337 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 191 packets, 15843 bytes)
pkts bytes target prot opt in out source destination
5428 435K MASQUERADE all -- eth0 10.8.0.0/24 0.0.0.0/0
1368 87373 MASQUERADE all -- tun0 10.8.0.0/24 0.0.0.0/0

----------------------------------

Server-2

port 444
local 2.2.2.2
dev tun
proto tcp-server
ifconfig 192.168.1.1 192.168.1.2
tls-server
daemon
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/tls.key 0
cipher AES-256-CBC
max-clients 1
persist-key
persist-tun
script-security 3
log vpn.log
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
tun-mtu 1500
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh

#cat up.sh
#!/bin/bash
LIP=2.2.2.2
/sbin/iptables -t nat -A PREROUTING -p tcp -d $LIP --dport 443 -j DNAT --to-destination 192.168.1.2
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.2 -j SNAT --to $LIP
----------------------------------------

#cat user.conf

client
remote 1.1.1.1 443
proto tcp
dev tun
ca ca.crt
dh dh2048.pem
cert user1.crt
key user1.key
tls-auth tls.key 1
cipher AES-256-CBC
verb 3
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
resolv-retry infinite
nobind
route-method exe
route-delay 2