Proxying traffic from one VPN to another

[juttkaleem214]

I have a homelab running Debian. I connect to it via Wireguard. I would like to forward non-local http traffic through to NordVPN from the server. This way I can use my home server vpn accessing local resources while also gaining the benefits of an external VPN service. calvindude vietnam

At first I thought a double VPN would be possible, where the server is connected to NordVPN itself. But since NordVPN does not offer port forwarding I would have no way of connecting to the server.

I am guessing the solution will require some IP table wizardry.

[Georg Pauwen]

Hello,

my first thought is: virtualization. Does your setup support that ?

[Seb Rupik]

Hi there,

The issue you will encounter will relate to default gateway used by the server. For wireguard to work and allow you to connect from any global routable public IP, the debian server must have a default gateway of your boundary router.

For NordVPN to work, it will adjust your routing table such that the default gateway will become the remote VPN tunnel endpoint. When the NordVPN is active, your traffic will path will be asymetric as return packets will leave via the NordVPN interface....this may not work at all.

@Georg Pauwen makes a good suggestion, spinning up a VM to host the NordVPN tunnel would provide you with separate routing tables, and using iptable to forward packets from the debian server to the VM would be the way to go. This page has what looks like the right iptables config:

https://wiki.vpsget.com/index.php/Forward_(redirect/nat)_traffic_with_iptables

Certainly a linux OS can host multiple routing tables, there must be way of placing the NordVPN interface in a separate routing table and use iptables to move traffic between the routing tables. .... I am thinking out loud and not sure if this is possible

cheers,

Seb.

[mursalahmed888]

You can route normally - by destination address/network - or route based on policy (PBR) - by source address/network, protocol site