Q: How do I "route" traffic from clients to the internet

supercoffee

I am not a networking nerd, but I do unsderstand the basics and already have a functioning OVPN server configured the way I like it.
The set up is as follows:

My server has one NIC, which connects to the LAN side of my home network.
The server uses a bridged configuration
The 'router" for the house forwards port 1194 UDP to the VPN server inside the network

In the current configuration, I can connect to the VPN using viscosity on my Mac, and reach internet resources just fine. However, from the same remote location, when connecting with my Linux desktop, I cannot reach internet resource when connected to the VPN. Pinging while connected to the VPN yields this: (192.168.17.51 is my IP for my desktop's TAP device while connected, dynamically assigned)

ben@sfg2:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 192.168.17.51 icmp_seq=1 Destination Host Unreachable
From 192.168.17.51 icmp_seq=2 Destination Host Unreachable
From 192.168.17.51 icmp_seq=3 Destination Host Unreachable

What client settings do I need to change on my desktop to get this to work? (I used the OVPN network manager plugin to configure the connection.)

maikcat

without configs/logs its imposible to tell what is happening...

Michael.

supercoffee

here is the log from only my desktop http://pastebin.com/9E7ebZVg
here is the log for only my laptop http://pastebin.com/e5SXmjAh

Keep in mind that I can access the internet from my laptop while connected to my vpn and all the traffic runs through the vpn. My desktop can only access "LAN" resources and have absolutely no internet access. I cannot even ping IP addresses beyond the LAN.

maikcat

hi there,

still no configs.....

please post them here...

Michael.

supercoffee

Sorry about that. here is the config file from the client.

route-gateway 192.168.17.1
remote xx.xxx.170.1 1194 udp
pull
tls-client
persist-key
ca ca.crt
redirect-gateway def1
dev tap
persist-tun
cert sfg2.crt
comp-lzo adaptive
nobind
key sfg2.key
dhcp-option DNS 8.8.8.8

here is the server's config

port 1194

proto udp

dev tap0

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret

dh dh1024.pem

ifconfig-pool-persist ipp.txt

server-bridge 192.168.17.20 255.255.255.0 192.168.17.50 192.168.17.100

;server-bridge

;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"

;client-to-client
keepalive 10 120

;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES

comp-lzo

;max-clients 100

user nobody
group nogroup

persist-key
persist-tun

log /var/log/openvpn.log
;log-append  openvpn.log

verb 6

;mute 20

This config was generated by viscosity on my Mac. Putting on my desktop and running OVPN manually actaully got me to the internet, but DNS seems to not work properly. I can ping internet resources, like Google's DNS server, but I cannot load web pages still.

ben@sfg2:~/openvpn$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 192.168.17.20: icmp_seq=1 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=1 ttl=48 time=147 ms
From 192.168.17.20: icmp_seq=2 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=2 ttl=48 time=133 ms
From 192.168.17.20: icmp_seq=3 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=3 ttl=48 time=51.0 ms
From 192.168.17.20: icmp_seq=4 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=4 ttl=48 time=135 ms
From 192.168.17.20: icmp_seq=5 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=5 ttl=48 time=150 ms
From 192.168.17.20: icmp_seq=6 Redirect Host(New nexthop: 192.168.17.1)
64 bytes from 8.8.8.8: icmp_req=6 ttl=48 time=119 ms
64 bytes from 8.8.8.8: icmp_req=7 ttl=48 time=119 ms

supercoffee

Can anyone help me? I posted the configs for the client and server.

maikcat

hi there,

for start,

is your bridging setup working? i mean can you access pcs on your lan?

if you do a traceroute to 8.8.8.8 what it shows?

Michael.

supercoffee

I figured it out. I just needed to update /etc/resolv.conf to reflect the DNS server on my remote LAN, or another DNS server.

My question now is how do I go about writing a script to update my /etc/resolv.conf every time I start and stop the VPN?