Client as gateway: How to send only some traffic through VPN

jhharvest

I have a feeling this isn't just an OpenVPN question but I hope some kind soul will give me a pointer to the right direction as I'm a bit stumped.

Background:
I have three machines: server, client and dumb terminal. The server and client are connected with OpenVPN tunnel. The client is acting as a gateway for dumb terminal.

The server is an Ubuntu (12.04) box. The client is Os X and the dumb terminal is a PS3.

Goal:
I want to route the dumb terminal's traffic through the tunnel but I want the client's traffic to go elsewhere (en1). The reason for this is that I have limited bandwidth allowance on the server.

Current state of affairs:
In my current configuration I can route everything from client and dumb terminal through the tunnel and it works as expected. To achieve this I've executed:

/usr/sbin/natd -a 192.168.2.2 -n tun0 -dynamic -s -m -u -clamp_mss -enable_natportmap -natportmap_interface en1
/sbin/ipfw add 00100 divert natd all from any to any via tun0

The dumb terminal is configured so that its gateway is the client. Once I open the VPN connection, all the traffic from the dumb terminal is correctly redirected via the tunnel. However I'd prefer not to send the client's traffic through the VPN.

server.conf

proto tcp-server
port 1194
dev tun
secret openvpn.key
ifconfig 192.168.2.1 192.168.2.2
keepalive 10 120
comp-lzo
persist-key
persist-tun
status server-tcp.log
log openvpn.log
verb 3

client.conf

dev tun
proto tcp-client
remote address_of_server 1194
connect-retry-max 1
connect-timeout 60
resolv-retry 1
nobind
secret openvpn.key
comp-lzo
verb 6
ifconfig 192.168.2.2 192.168.2.1
dhcp-option DNS trusted_dns_server_ip
redirect-gateway def1
socks-proxy localhost 9090
route ip_of_server 255.255.255.255 net_gateway

I've tried disabling redirect-gateway in the client configuration. The tunnel opens just fine, and I can ping the server from the client, but for some reason none of my traffic gets tunnelled through the VPN after that.

So, gents and ladies, what further commands do I need to execute to connect the dumb terminal to the VPN?

janjust

you're using a socks proxy host - make sure that there is also a direct route to the remote end of the socks tunnel. Does it work without 'redirect-gateway' : if so , then it's a routing issue. If not, then the problem lies elsewhere.

jhharvest

Thanks janjust. There is a route to the socks proxy host. It's the same machine as the vpn server. I need to tunnel the traffic over a proxy as I'm behind a very restrictive firewall.

The configuration works with redirect-gateway. Then all traffic, both from the client and the dumb terminal, gets routed via VPN. But this isn't really what I want. Also, if I manually set routes in the client machine the traffic to those destination IPs gets routed over the VPN. However, my goal is to have all the traffic from the dumb terminal to go over the VPN and none of the traffic from the client machine.

So, to recap:
the client machine has local ip 192.168.1.10
the terminal has local ip 192.168.1.11

the client machine works as a gateway for the terminal

I want the client machine to route all traffic from local ip 192.168.1.11 to route over the VPN tunnel (i.e. via tun0).
I want all traffic originating from 192.168.1.10 to go to the regular interface (en1).

janjust

Definitely a routing issue :shock:
you can use either iptables for this by redirecting all traffic coming from the .11 address to go out the tun adapter, or you might be able to use separate routing tables (on Linux ) for this.

jhharvest

Okay, thanks. Could you throw me a bone and give me an example iptables configuration how to do this? I've been trying all day with ipfw+natd and I just can't get it to work.

With ipfw+natd I've run into two scenarios:
If I don't add routes 0/1 and 128/1 via tun0 then natd complains

In  [UDP]  [UDP] 192.168.0.11:61168 -> 8.8.8.8:53 aliased to
           [UDP] 192.168.0.11:61168 -> 8.8.8.8:53
Out [UDP]  [UDP] 192.168.0.11:61168 -> 8.8.8.8:53 aliased to
           [UDP] 192.168.2.2:61168 -> 8.8.8.8:53
natd: failed to write packet back: No route to host

If I add them, then all my traffic gets routed over the VPN.

janjust

it's more source routing than iptables what you need; I'd try something like

ip route add to default table 100 dev tun0 via 192.168.2.1
ip rule add from 192.168.0.11 priority 50 table 100
ip rule add to 192.168.0.11 priority 50 table 100

jhharvest

Yeah, I see. I may have to ditch this: I'm running Os X and the kernel isn't built for multiple routing table support and even porting iptools2 is purportedly difficult. Cheers for the help though, janjust!

Os X 10.7 Lion has pf instead of ipfw. pf supposedly can do this and many other things...