IP Tunneling from OVH to Hetzner

Zreind

Hello,

I have 2 servers.
First one is the vps bought from ovh and have /29.
Second one is the bare metal i bought from Hetzner.

If you have ever noticed the IP prices on Hetzner, you wouldn't use it.

I want to use this /29 subnet or even 1-2 IP's to use it in my Hetzner server.
The main problem is, i have some vpses on dedicated and want to give this ips to them without doing anything on them (just adjusting hypervisor)

I use KVM and tried to do it with ZeroTier, WireGuard etc. but still not working.

I don't know much about networking so please help me like a helping a noob

comXyz

I think what you should search is "GRE tunnel between two Linux servers".
I did it long time ago and it worked, but I don't remeber the details.

ehab

wireguard

Zreind

@ehab said:
wireguard

i know wireguard think but dont know how to do it with hypervisor bridge and details

tjn

If you can tell us more about what you have setup on the Hetzner side, we can probably advise you better

Zreind

@tjn said:
If you can tell us more about what you have setup on the Hetzner side, we can probably advise you better

there is just qemu kvm and a nat bridge for nat vps

Neoon

People tried that before, It won't work stable, especially under DDoS.
Your Tunnel just gets dropped or slowed below usable speeds.

Zreind

@Neoon said:
People tried that before, It won't work stable, especially under DDoS.
Your Tunnel just gets dropped or slowed below usable speeds.

I want to learn it only. Also we need only 1 ip to host a machine not for a big production. I see you own microlxc and the free kvm thing. Can you help me a bit to do it with zerotier or wireguard? (gre is not safe)

RickBakkr

The means of transport, albeit GRE, Wireguard, … shouldn’t really affect the basic concept of what you like to achieve.

1. Get a point to point tunnel set up between both sides
2. Route OVH IPs over tunnel
3. Route OVH IPs on Hetzner side to bridge
4. Configure ip rule/vrf to have outgoing traffic return over tunnel back to OVH
5. Done.

zenocz

any vpn works on layer3 will be ok,I used it connecting vultr to bwh for years.

FlorinMarian

I have done this several times with the method below and it works with (Proxmox/Debian/Ubuntu) and the idea behind it is simple.
The VM receives a private IP and at the hypervisor level you map a certain private IP address to a certain public IP address.

I warn you that you cannot pass the security layers of the OVH and the speeds will be deplorable, especially when you do speedtests.

=========================================================
Source of IP addresses:
=========================================================
sudo modprobe ip_gre
lsmod | grep gre

sudo bash -c 'cat >> /etc/network/interfaces' <<- EOL
auto gre1
iface gre1 inet static
    address 172.16.0.1
    netmask 255.255.255.0

    pre-up ip link add gre1 type gretap local 5.183.170.160 remote 65.109.64.177 ttl 255
    post-down ip link del gre1 
EOL


Important:
1. OVH: Ne asigurăm că nu există o adresă MAC pentru această adresă IP
2. Adăugăm adresa IP ca alias:
    ip addr add 162.19.129.221/32 dev vmbr0
3. Mapăm adresele IP interne cu cele publice:
    iptables -t nat -I PREROUTING -d 162.19.129.221 -j DNAT --to-destination 172.16.0.3
    iptables -t nat -I POSTROUTING -o vmbr0 -j MASQUERADE


=========================================================




=========================================================
Who uses those IP addresses:
=========================================================
sudo modprobe ip_gre
lsmod | grep gre

sudo bash -c 'cat >> /etc/network/interfaces' <<- EOL
auto vmbr0
iface vmbr0 inet manual
    address 172.16.0.2/24
    gateway 172.16.0.1

    pre-up ip link add gre1 type gretap local 65.109.64.177 remote 5.183.170.160 ttl 255
    pre-up ip link set gre1 up

    bridge-ports gre1
    bridge-stp off
    bridge-fd 0

    post-up echo 1 > /proc/sys/net/ipv4/ip_forward

    post-down ip link set gre1 down
    post-down ip link del gre1
EOL

VM config:
172.16.0.3 - 254
Gateway: 172.16.0.1
Netmask: 255.255.255.0

=========================================================

ehab

@FlorinMarian said:

gre sucks a lot of bandwidth. an Idle 2 nodes was eating >1TB over night.

so unless you have a unlimited then i don't advise gre.

kkiskk

IPsec VPN may be helpful for you?

theraw

cloudflare tunnels?