OpenVPN with LAN Access Only

user7743

Hi all,

I have managed to get a basic OpenVPN configuration setup and working. As it stands now, when users connect all traffic is routed through the VPN. This is great for one use case I have in mind (ie when I work in the middle east). I am now considering another type of configuration that I would like help with.

In the second configuration I would like users to connect and only LAN traffic routed over the VPN to get access to some file servers that sit behind the VPN Server/router. All other traffic should go over their normal internet connection and not over the VPN, traffic such as internet browsing.

Eventually I would like to try and combine the setups and have two classes of users and use soemthing like CCD to set the right configuration. That can come later once I have only the selected data going over the VPN.

Here is what my setup looks like today. PC running as a router with 2 ethernet connections. br0 is a bridge of eth0 connected to the LAN (10.10.10.0/24) and tap0 for OpenVPN. eth1 is connected directly to the internet and gets its ip via DHCP from my ISP. This machice acts as the gateway for the LAN, provides DHCP & DNS for the LAN, SSH and OpenVPN service coming from the internet.

Can someone point me in the right direction to get option 2 working. It would be appreciated!

server config

port 1194
proto udp
dev tap0
ca /etc/pki/ca.pem
cert /etc/pki/cert.pem
key /etc/pki/key.pem
dh /etc/pki/dh.pem
crl-verify /etc/pki/crl.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.10.10.1 255.255.255.0 10.10.10.200 10.10.10.250
push "route 10.10.10.0 255.255.255.0"
push "dhcp-option DNS 10.10.10.1"
mode server
client-to-client
client-config-dir ccd
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 6

client config

client
dev tap
proto udp
remote server.dyndns.org 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.pem
cert cert.pem
key key.pem
comp-lzo
verb 5

Mimiko

As this is a bridge setup, you don't have to push to client local lan, as client will already be from that lan. The config you provided is viable, so try and see logs and responces.

user7743

Hi all,

I am back and have been able to test with an external connection a little. It looks like my problem might be something to do with the client I am using (Fedora 17 with Gnome VPN packages). I got a friend to connect from his DSL connection using the openvpn client for windows and he was connected properly.

Firstly, without connecting to the VPN, this is the route that is set by the router on the guest DSL connection.

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0

When I browse and check my IP I get the expected external IP of the DSL connection I am on.

Next I connect to the VPN using Fedora and I get the following route (same configuration as above)

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.10.10.1      0.0.0.0         UG    0      0        0 tap0
10.10.10.0      *               255.255.255.0   U     0      0        0 tap0
HSI-149-172     192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0

Browsing in this state I get the external IP of my home DSL connection.

I manually run two route commands

route add default gw 192.168.1.1
route delete default gw 10.10.10.1

And I am back to the external IP of the guest DSL.

The work around does not explain why the problem occurs, but it does work around it.

Mimiko

In you config I don't see any "redirect-gateway" option, but from you routing table it seems a redirect-gateway is applied. Do you use different configs other than that posted?