Client acting as router

craigjw

Hi,

I have a client PC (192.168.10.2 /24) that I use to connect to a OpenVPN server (LAN behind it is 192.168.15.0 /24). Client PC gets a 10.10.10.2 address to connect to the OpenVPN 10.10.10.1

Is it possible to set the other PCs on the clients LAN (e.g. other-pc with IP of 192.168.10.10) to be able to router through that client to connect to systems on the other side of the VPN? So, 192.168.10.2 could ping 192.168.15.2)

OpenVPN server is setup in Tunnel mode.

Thanks
Craig

maikcat

yes you can setup openvpn in lan-to-lan scenario...

post configs and i will help you

Michael.

craigjw

Thanks, configs are below:

* blah.ovpn *
----------------
client
dev tun
proto udp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
tls-client
ns-cert-type server
persist-key
persist-tun
auth-user-pass
auth-retry interact
reneg-sec 86400
ca c:\\openvpn\\keys\\ca.crt
cert c:\\openvpn\\keys\\xxx.crt
key c:\\openvpn\\keys\\xxx.key
tls-auth c:\\openvpn\\keys\\secret.key 1
cipher AES-192-CBC
comp-lzo
verb 3

* server.conf *
----------------
local 192.168.15.40
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.15.0 255.255.255.0"
keepalive 10 120
tls-auth q6secret.key 0 # This file is secret
cipher AES-192-CBC # AES
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/auth/auth-ldap.conf"

maikcat

hi there,

you must use ccd files so that openvpn can route back to the remote subnet,

so add this to your config:

client-config-dir ccd
route 192.168.10.0 255.255.255.0

create a file named after your certs canonical name with the following in it:

iroute 192.168.10.0 255.255.255.0

you need to enable ip forwarding on your client also...

Michael.

craigjw

Thanks Michael.

My certificate file is blah.crt, so i created a file in the ccd folder named blah and entered:

iroute 192.168.15.0 255.255.255.0

and reloaded, but no joy in getting to the remote computers from another computer on the same LAN as the client.

Do those other computers need to know about the private 10.10.10.0/24 that i have for the tunnel?

IP Forwarding is enabled on the client PC.

maikcat

just to remind you that the network entered on ccd file is about the REMOTE subnet
not openvpn servers one..

to ensure that your ccd is read add an ifconfig-push statement to force a static ip to your client
if he gets it then your ccd is ok...

did you enable ip forwarding on client?

Michael.

craigjw

Hi Michael,

Yes, the remote clients subnet is what I have in the CCD file. Also added the ifconfig-push
statement to ensure its being read.

Yes, IP forwarding (ie routing) is enabled on my client.

Still not getting responses to the pings though. To clarify, do the systems on the other subnet need to know how to route back to the clients subnet? They can all ping my client on its private-IP address as assigned from the ifconfig-pushfile but can't ping the real IP address, just wondering how they can get back to the real IPs of other systems if they dont have a private-IP address in the ifconfig-push range?

Thanks

sorianatica

i have the same problem thar craigjw

My problem is than the "clients" on client, (with same ips than craigjw) the network 192.168.10.0, with the command route in the "clients" is:

0.0.0.0 0.0.0.0 192.168.10.2(IP client openvpn) 192.168.10.5(Ip lan client)
127.0.0.1 255.0.0.0 127.0.0.1 127.0.0.1
192.168.10.0 255.255.255.0 192.168.10.2 192.168.10.2
192.168.10.5 255.255.255.255 127.0.0.1 127.0.0.1
192.168.10.255 255.255.255.255 192.168.10.2 192.168.10.2
224.0.0.0 240.0.0.0 192.168.10.2 192.168.10.2
255.255.255.255 255.255.255.255 192.168.10.2 192.168.10.2
Gateway Def 192.168.10.2

I think that my english is very bad, Im sorry

sorianatica

I have the same problem in my installation of openvpn

I think that the problem is route in lan of client, because there isnt route to server of OpenVpn.

maikcat

To clarify, do the systems on the other subnet need to know how to route back to the clients subnet?

yeap , unless someone is NATing along the way..
in your case you NEED to configure routing properly,
this can be done in 2 ways:

1) add a static route for the remote/vpn subnet pointing to openvpn client to everyone

2) add a static route for the remote/vpn subnet pointing to openvpn client to your default gateway

the above stands for server side also,meaning that your openvpn server side pcs
must know where to route packets for the remote network...

Michael.

craigjw

Finally got it working, thanks for the pointers Michael.

Here's what I did:

OpenVPN Server side:
On the router:
added a route to point the VPNs private-subnet to the OpenVPN Server
added a route to point the client side subnet to the OpenVPN Server

On VPN Server:
added iroute commands in clients ccd file to specify client side subnet
added route command in server.conf under the client-config-dir ccd command

On client subnet:
Either set the clients default-gateway to be the OpenVPN client or,
specify an route add command to point server side subnet to the OpenVPN client.

maikcat

ok then

closing topic

Michael.