Make OpenVPN clients accessible internally

Loadeed

I have an internal network of 192.168.1.0/24 and a VPN server on 192.168.200.1 that handles VPN clients. Each VPN client has it's own IP in 192.168.200.0/24 network. My router is on IP 192.168.1.1 and is connected to the Internet. I have configured the whole thing so that VPN clients can connect to computers in my internal network (192.168.1.0/24).

What do I have to do to allow internal computers connect to VPN clients?

maikcat

hi there,

you must:

configure routing
configure firewall on clients & local lan pcs
configure routing on openvpn server itself

what problem do you have?

also post configs.

Michael.

Loadeed

We have VPN server (network 192.168.200.0/24), one VPN client (network 192.168.200.0/24), ruter one machine behind the server in LAN (192.168.1.0/24).

VPN server ip: 192.168.200.1
VPN server ip LAN: 192.168.1.109
VPN client: 192.168.200.11
LAN machine: 192.168.1.120
ruter: 192.168.1.1

The VPN client can ping machines in the LAN, but machines in LAN can't ping VPN client connected to VPN server. It seems ping from 192.168.1.120 goes to 192.168.1.1 (ruter) and then it gets lost.

We have enabled ipv4 forwarding on the VPN server and on ruter we have configured route:

Destination LAN Mask Gateway
192.168.200.0 255.255.255.0 192.168.1.109

Loadeed

Here are the config files:

VPN Client:
client
proto udp
remote 192.168.1.109
port 1194
comp-lzo
dev tun
nobind
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server

VPN Server:
local 192.168.1.109
proto udp
port 1194
dev tun
comp-lzo
server 192.168.200.0 255.255.255.0
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
persist-key
persist-tun
keepalive 10 60
topology subnet
;user nobody
;group nobody
daemon
log-append /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 3
management localhost 7505
client-config-dir ccd
ccd-exclusive
route 192.168.200.0 255.255.255.0

Client CCD:
ifconfig-push 192.168.200.11 255.255.255.0
push "route 192.168.1.7 255.255.255.255"
push "route 192.168.1.5 255.255.255.255"

EDIT:
When we put: push "route 192.168.1.120 255.255.255.255" to the client CCD, then it works, but I don't think this is a very good solution.

maikcat

can you post the output of

iptables -L -t nat -v
from your openvpn server?

also

if a client can reach a pc inside your network then routing is ok,
but what is bothering me is this

When we put: push "route 192.168.1.120 255.255.255.255" to the client CCD, then it works, but I don't think this is a very good solution.

also remove this from your server config

route 192.168.200.0 255.255.255.0

one more thing,i noticed for remote you are using lan ip of openvpn server,

how exactly are you testing your setup?

Michael.

Loadeed

Ok today we managed to ping VPN client (192.168.201.1) from local machine (192.168.1.120). But now we have to add ACCEPT rule to FORWARD chain for every local machine in 192.168.1.0 network?

VPN server:

local 192.168.1.109
proto udp
port 1194
dev tun0
comp-lzo
server 192.168.200.0 255.255.255.0
route 192.168.201.0 255.255.255.0
push route "192.168.1.0 255.255.255.0"
ca ca.crt
cert http://server.crt
key http://server.key
dh dh1024.pem
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"
keepalive 10 60
user vpn
group vpn
daemon
log-append /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 3
management localhost 7505
client-config-dir ccd
ccd-exclusive

VPN client:
New VPN client ip: 192.168.201.1

client
proto udp
remote EXTERNAL_IP
port 1194
comp-lzo
dev tun
nobind
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server

VPN client ccd:

ifconfig-push 192.168.201.1 192.168.201.2

iptables -L -n OUTPUT:

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 192.168.201.0/24 192.168.1.1
ACCEPT all -- 192.168.1.0/24 192.168.201.0/24
ACCEPT all -- 192.168.201.0/24 192.168.1.120
ACCEPT all -- 192.168.201.0/24 192.168.1.131
REJECT all -- 192.168.201.0/24 192.168.1.0/24 reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

maikcat

hi there,

there are some things in your setup that trouble me...

from your server i assume the following:

your LAN subnet (behind your openvpn server) is 192.168.1.0/24

the vpn virtual subnet is 192.168.200.0/24

your clients private lan is 192.168.201.0/24

am i right so far?

then i see your ccd file which you are pushing 192.168.201.1 to your client,
thats not right,you cant push an ip to your client OUTSIDE the scope of your vpn tun adapter
in your case 192.168.200.0...

also i asked to post the output of

iptables -L -t nat -v

because i wanted to check if you are NATing somewhere...

adding that keeping default policy accept then creating a generic reject rule,
well is not quite right... change the policy to reject and add accept rules 😉

also for testing disable for now filtering rules... (one step at a time)

Michael.

Loadeed

We configured VPN according to this:
http://openvpn.net/index.php/open-source/documentation/howto.html#policy

VPN client subnet is not 192.168.201.0/24. We do not know the client subnet, we only want to give static IP address to VPN clients.
LAN subnet is 192.168.1.0/24
VPN virtual subnet is 192.168.200.0/24

iptables -L -t nat -v OUTPUT:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
[2]+ Exit 1 shorewall

maikcat

hi there,

your initial post

I have an internal network of 192.168.1.0/24 and a VPN server on 192.168.200.1 that handles VPN clients. Each VPN client has it's own IP in 192.168.200.0/24 network. My router is on IP 192.168.1.1 and is connected to the Internet. I have configured the whole thing so that VPN clients can connect to computers in my internal network (192.168.1.0/24).

has nothing to do with this

http://openvpn.net/index.php/open-source/documentation/howto.html#policy

the link you are reffering explains how you can configure clients dividing them as groups
by assining them ips from different subnets...

your initial setup is quite simple

push the route for your local lan to your clients
disable any firewall rules on your openvpn server itself
enable ip forwarding on openvpn server
configure routing for your internal lan pcs to route packets destined to vpn tunnel correctly
configure firewall on your clients to allow traffic from your internal lan to their tap adapter

regards

Michael.