Use Raspberry Pi as VPN gateway specific hosts on VLAN?

Question

I've been trying to figure out how to do this for awhile now and I'm not even sure if what I want to do is possible at this point. I'm trying to update and simplify my current network while maintaining it's existing functionality. I'm thinking maybe it's not even possible how I would like to set this up, or maybe there's a better way I'm not aware of - hoping someone could offer some clarity.

Here is my current network topology:

R1 has two networks configured based on the ports being used. R1 also has a VPN connection set up and routes all devices on the 192.168.15.0/24 network through the VPN. The 192.168.15.0/24 is completely segregated from the 192.168.0.0/24 network. R2 is configured purely as an access point and does no routing or anything else fancy. The remaining set up for the 192.168.0.0/24 network is pretty standard, no VPN or special traffic segregation etc (they still can't communicate to the 192.168.15.0 network to be clear).

Here is the network topology I would like to move to:

Functionally I want to maintain the existing configuration if possible. My goal was that I would have the raspberry pi (with a connected USB to Ethernet adapter) encapsulate internet traffic on the 192.168.15.0/24 network to travel through the VPN. The existing segregation between 192.168.0.0 and 192.168.15.0 would remain.

I've tried adapting some of the existing guides online for creating a VPN access point with the raspberry pi, as well as the ones about using the pi as a router and can't seem to figure it out. R1 would remain as the DHCP server. S1 would actually be a layer 3 switch so it can potentially do VLAN's as well (if I understand correctly how layer 3 switches work anyways). I've also tried configuring the pi as a dhcp server only serving addresses out on the port facing Device Group 3, and it will hand the addresses out but then it can't route traffic back to S1 it seems. I've made sure packet forwarding is on, I've added / removed static routes on it to no avail.

Maybe I misunderstand and it's only possible to have the raspberry pi act like this when it's connected directly to the ISP modem? It's also completely possible I misconfigured something along the way too. If anyone could offer some guidance on if/how this could be possible I would greatly appreciate it!

Answer 1

I think what you are trying to achieve is possible.

But instead of trying the setup with the pi in "live mode", i would suggest you to set up two ubuntu vm's, with virtual box for example. This way you can quickly reboot, modify config files, re-arrange network connections, without the need to switch the computer / keyboard / cables.

Than you give to the first VM two ethernet devices (a,b) and to the second VM only one ethernet device (c). The goal should be to allow (c) to connect to (b) and use it's internetconnection at (a).

You set up device a) as bridge and devices b) and c) as internal.

This results in: The first VM has two ethernet cards. The bridged etherenet device (a) will recieve an IP from your router, while the second ethernet device (b) will not. This VM would be able to go online, ping google, etc.

The second VM will have an ethernet device (c), but no internet access, nor any IP assigned.

Now you can try the guides you found on the web and install inside the first VM a dhcp-server listening on device (b), that gives an IP to device (c) at the second VM, so that both VM's would be able to ping each other. The next step would be to allow the second VM to use the internetconnection (a) of the first VM, like a router would do. Therefor you have to configure iptables to do the proper routing for you. As a third step, you connect to a VPN-service with your first VM and try to share that to the second VM. Therefor you will again need to reconfigure your routing using iptables.

If you need a step by step guide for this, let me know, than i will create one for you.