Issue with bridging 3 client networks and an office

allanparsons

I have 3 Amazon VPCs (Dev - 10.100.0.0/16 , QA - 10.101.0.0/16, Prod - 10.104.0.0/16). Each of these VPNs has an OpenVPN server. They are dolling out client IPs as follows:

Dev - 10.100.0.0/16 - Tunnel 10.7.0.0/24
QA - 10.101.0.0/16 - Tunnel 10.8.0.0/24
Prod - 10.104.0.0/16 - Tunnel 10.9.0.0/24

I have an Ubuntu LTS 12.04 server running onsite and I've established 3 client connections (one to each VPC). I'm able to ssh into this Ubuntu box and get around all three subnets (10.100 , 10.101, 10.104) without any issues whatsoever.

Here's my client config [DEV / 10.100.x / tun 10.7.0.x]:

client
dev tun
proto udp
remote dev.ip.addr 1193 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Here's my client config [QA / 10.101.x / tun 10.8.0.x]:

client
dev tun
proto udp
remote qa.ip.addr 1194 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Here's my client config [PROD / 10.104.x / tun 10.9.0.x]:

client
dev tun
proto udp
remote prod.ip.addr 1195 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Now, I want my employees (internally, while at the office), to VPN to this server (192.168.1.19) which has 3 connections to my VPCs. And, i want them to be able to connect to 10.100, 10.101, and 10.104 networks (via sql cleints, telnet to memcache servers, etc). I want to route all traffic except 80,443, and 3389 through this vpn interface.

OpenVPN Server Config for Office Server (192.168.1.19 / tun 10.10.0.x):

port 1196
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.crt
key /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/login
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name

server 10.10.0.0 255.255.255.0
push "route 10.7.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
push "route 10.9.0.0 255.255.255.0"
push "route 10.10.0.0 255.255.255.0"
push "route 10.104.0.0 255.255.0.0"
push "route 10.101.0.0 255.255.0.0"
push "route 10.100.0.0 255.255.0.0"

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
verb 3

user nobody
group nogroup

log-append /var/log/openvpn
status /tmp/vpn.status 10

And here's the Config I'm handing out to employees (192.168.1.x / tun 10.10.0.x)

client
dev tun
proto udp
remote 192.168.1.19 1196 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

FROM THE SERVER (via ssh to 192.168.1.19):

I'm able to get to 10.104

I'm able to get to 10.101

I'm able to get to 10.100

root@vpn-hqs:~# traceroute 10.104.10.104
traceroute to 10.104.10.104 (10.104.10.104), 30 hops max, 60 byte packets
 1  10.9.0.1 (10.9.0.1)  86.094 ms  86.079 ms  86.079 ms
 2  10.104.10.104 (10.104.10.104)  86.084 ms  86.086 ms  86.087 ms
root@vpn-hqs:~# traceroute 10.100.10.168
traceroute to 10.100.10.168 (10.100.10.168), 30 hops max, 60 byte packets
 1  10.7.0.1 (10.7.0.1)  87.130 ms  87.121 ms  87.121 ms
 2  10.100.10.168 (10.100.10.168)  87.126 ms  87.238 ms  87.243 ms
root@vpn-hqs:~# traceroute 10.101.10.168
traceroute to 10.101.10.168 (10.101.10.168), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  87.954 ms  87.939 ms  87.937 ms
 2  10.101.10.168 (10.101.10.168)  87.943 ms  87.944 ms  88.031 ms
root@vpn-hqs:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 br0
10.7.0.0        10.7.0.17       255.255.0.0     UG    0      0        0 tun0
10.7.0.17       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.33       255.255.0.0     UG    0      0        0 tun1
10.8.0.33       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.9.0.0        10.9.0.13       255.255.0.0     UG    0      0        0 tun2
10.9.0.13       0.0.0.0         255.255.255.255 UH    0      0        0 tun2
10.10.0.0       10.10.0.2       255.255.255.0   UG    0      0        0 tun3
10.10.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun3
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0

Here's my if config of the server (192.168.1.19):

root@vpn-hqs:~# ifconfig -a
br0       Link encap:Ethernet  HWaddr 00:1d:09:26:43:3d  
          inet addr:192.168.1.19  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21d:9ff:fe26:433d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:17149 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2770 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2213528 (2.2 MB)  TX bytes:286915 (286.9 KB)

eth0      Link encap:Ethernet  HWaddr 00:1d:09:26:43:3d  
          inet6 addr: fe80::21d:9ff:fe26:433d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18666 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2773 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2719828 (2.7 MB)  TX bytes:300485 (300.4 KB)
          Interrupt:16 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.7.0.18  P-t-P:10.7.0.17  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:876 (876.0 B)  TX bytes:1104 (1.1 KB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.34  P-t-P:10.8.0.33  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1584 (1.5 KB)  TX bytes:2040 (2.0 KB)

tun2      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.0.14  P-t-P:10.9.0.13  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1584 (1.5 KB)  TX bytes:2040 (2.0 KB)

tun3      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.10.0.1  P-t-P:10.10.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:740 (740.0 B)  TX bytes:0 (0.0 B)

Now, I'm able to connect from my windows computer to 192.168.1.19 just fine. And, I get an IP address of 10.10.0.6. Perfect.

But, I can't connect / ping / telnet to anything on 10.104.0.0/16, 10.101.0.0/16, and 10.100.0.0/16 like I can when I'm ssh'd onto 192.168.1.19. Here's my route table for my windows box:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.220     10
          0.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
         10.7.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
         10.8.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
         10.9.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
        10.10.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
        10.10.0.1  255.255.255.255        10.10.0.5        10.10.0.6     30
        10.10.0.4  255.255.255.252         On-link         10.10.0.6    286
        10.10.0.6  255.255.255.255         On-link         10.10.0.6    286
        10.10.0.7  255.255.255.255         On-link         10.10.0.6    286
       10.100.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
       10.101.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
       10.104.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
      192.168.1.0    255.255.255.0         On-link     192.168.1.220    266
     192.168.1.19  255.255.255.255      192.168.1.1    192.168.1.220     10
    192.168.1.220  255.255.255.255         On-link     192.168.1.220    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         10.10.0.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.220    266
  255.255.255.255  255.255.255.255         On-link         10.10.0.6    286
===========================================================================
Persistent Routes:
  None

Any help getting my 10.10.0.0/24 VPN'd clients talking to 10.100.0.0/16, 10.101.0.0/16, and 10.104.0.0/16 clients would be GREATLY appreciated!

*****
ALSO FYI, this was cross posted to:
http://serverfault.com/questions/471599/issue-with-openvpn-acting-as-client-server
*****

maikcat

hi there,

interesting stuff... 😃

you can accomplish your scenario by 2 ways:

1) create NAT rule on your 192.168.1.19 server which will NAT all traffic from eth to each tun
interface (so that ALL requests from your client will appear to be request from your vpn (192.168.1.19) client itself

2) configure routing creating lan-to-lan scenario (by using ccd files with iroute directives)

to filter out traffic you will need iptables... 🙁

regards

Michael.

allanparsons

I've also tried the following IP table rules which don't work 🙁

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Masquerade traffic from VPN client network to the 10.100/16 tunnel interface
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o tun0 -j MASQUERADE
# Same for other VPC networks
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o tun1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o tun2 -j MASQUERADE
# Allow VPN clients out to the internet
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o br0 -j MASQUERADE

# Allow established traffic to pass back and forth
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Allow traffic from 10.10.0.0/24 to tunnel going to 10.100/16
iptables -A FORWARD -i tun3 -o tun0 -j ACCEPT
# Allow traffic from 10.100/16 to tunnel going to 10.10.0.0/24 
iptables -A FORWARD -i tun0 -o tun3 -j ACCEPT

# Allow traffic from 10.10.0.0/24 to tunnel going to 10.101/16
iptables -A FORWARD -i tun3 -o tun1 -j ACCEPT
# Allow traffic from 10.101/16 to tunnel going to 10.10.0.0/24 
iptables -A FORWARD -i tun1 -o tun3 -j ACCEPT

# Allow traffic from 10.10.0.0/24 to tunnel going to 10.104/16
iptables -A FORWARD -i tun3 -o tun2 -j ACCEPT
# Allow traffic from 10.104/16 to tunnel going to 10.10.0.0/24 
iptables -A FORWARD -i tun2 -o tun3 -j ACCEPT

ip route flush cache

Output of: iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL

root@vpn-hqs:/home/admin# iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL
Chain INPUT (policy ACCEPT 240 packets, 31163 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  tun3   tun0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun0   tun3    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun3   tun1    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun1   tun3    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun3   tun2    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun2   tun3    0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 127 packets, 12709 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 133 packets, 37453 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 51 packets, 7754 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 2 packets, 124 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 2 packets, 124 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      tun0    10.10.0.0/24         0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      tun1    10.10.0.0/24         0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      tun2    10.10.0.0/24         0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      br0     10.10.0.0/24         0.0.0.0/0           
Chain PREROUTING (policy ACCEPT 1571 packets, 130K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 1489 packets, 100K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1364 packets, 140K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 1364 packets, 140K bytes)
 pkts bytes target     prot opt in     out     source               destination

allanparsons

To give you a better idea of what I'm trying to accomplish, here's an image:

maikcat

i will try within the day to emulate your setup...

if you try to connect from a pc on a lan side of your openvpn server (with the 3clients)
can you reach the remote vpns?

if the NAT thing dont work you can configure lan-to-lan connectivity...

please wait until i test your topology..

ps: is ip forwarding enabled on multi client/server pc?

EDIT if you try this rules:
-A POSTROUTING -o tun0 -j MASQUERADE
-A POSTROUTING -o tun1 -j MASQUERADE
-A POSTROUTING -o tun2 -j MASQUERADE
any luck?

Michael.

allanparsons

Hey Michael:

Thanks for trying to emulate.

On the Client/Server linux box, ip forwarding is enabled:

root@vpn-hqs:/home/admin# cat /etc/sysctl.conf  | grep net.ipv4.ip_forward
net.ipv4.ip_forward=1

When I attempt to add those postrouting rules, I'm getting an error:

root@vpn-hqs:/home/admin# iptables -A POSTROUTING -o tun1 -j MASQUERADE 
iptables: No chain/target/match by that name.
root@vpn-hqs:/home/admin# 
root@vpn-hqs:/home/admin# 
root@vpn-hqs:/home/admin# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.7.0.0        10.7.0.17       255.255.0.0     UG    0      0        0 tun0
10.7.0.17       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.33       255.255.0.0     UG    0      0        0 tun1
10.8.0.33       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.9.0.0        10.9.0.13       255.255.0.0     UG    0      0        0 tun2
10.9.0.13       0.0.0.0         255.255.255.255 UH    0      0        0 tun2
10.10.0.0       10.10.0.2       255.255.255.0   UG    0      0        0 tun3
10.10.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun3
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

maikcat

for the iptables thing...

add the -t nat in front (i copied straight from/etc/sysconfig/iptables 🙂

Michael.

allanparsons

Still no luck.

From linux client/server (192.168.1.19):

After running:

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun2 -j MASQUERADE

root@vpn-hqs:/etc/openvpn/client# iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL
Chain INPUT (policy ACCEPT 20817 packets, 4413K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 29 packets, 2031 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 6153 packets, 613K bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 1984 packets, 271K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 1861 packets, 265K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 24 packets, 1488 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 48 packets, 3184 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      tun0    0.0.0.0/0            0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      tun1    0.0.0.0/0            0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      tun2    0.0.0.0/0            0.0.0.0/0           
Chain PREROUTING (policy ACCEPT 21135 packets, 4410K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3389 MARK set 0x1
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 MARK set 0x1
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 MARK set 0x1
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 MARK set 0x1

Chain INPUT (policy ACCEPT 20639 packets, 4388K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 29 packets, 2031 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 5989 packets, 603K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 6018 packets, 605K bytes)
 pkts bytes target     prot opt in     out     source               destination

From my windows PC laptop:

===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.220     10
          0.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
         10.9.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
        10.10.0.1  255.255.255.255        10.10.0.5        10.10.0.6     30
        10.10.0.4  255.255.255.252         On-link         10.10.0.6    286
        10.10.0.6  255.255.255.255         On-link         10.10.0.6    286
        10.10.0.7  255.255.255.255         On-link         10.10.0.6    286
       10.104.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
     72.87.249.74  255.255.255.255      192.168.1.1    192.168.1.220     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
      192.168.1.0    255.255.255.0         On-link     192.168.1.220    266
    192.168.1.220  255.255.255.255         On-link     192.168.1.220    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         10.10.0.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.220    266
  255.255.255.255  255.255.255.255         On-link         10.10.0.6    286
===========================================================================

allanparsons

OK, so, I decided to try the guide at this URL (http://backreference.org/2009/11/15/openvpn-and-iroute/), which basically uses ccd files.

I have a user for each VPC. But, for debug purposes, I'm only focusing on dev.

USER: dev-hqs
Network: 10.100.0.0/16
VPN GW: 10.0.0.2/24

The vpn "server" is acting as a client in the 10.100.0.0/16 network and connects to my main office SERVER (which is acting purely in a server capacity now). This server sits in 192.168.1.0/24. And, I can browse from this server to anything 10.100.0.0/16. OK, good.

But, now my:
1) My roadwarriors are connecting to the office SERVER too (in 192.168.1.0/24). They are getting an IP of 10.0.0.2 (!!??)
2) They can ping 10.0.0.1 and ping 10.0.0.2. But, I can't connect to 10.100.0.0/16. 🙁 Here's the routes for the test user on windows:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.220     10
         10.0.0.0    255.255.255.0         On-link          10.0.0.2    286
         10.0.0.0    255.255.255.0         10.0.0.1         10.0.0.2     30
         10.0.0.2  255.255.255.255         On-link          10.0.0.2    286
       10.0.0.255  255.255.255.255         On-link          10.0.0.2    286
       10.100.0.0      255.255.0.0         10.0.0.1         10.0.0.2     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.220    266
    192.168.1.220  255.255.255.255         On-link     192.168.1.220    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link          10.0.0.2    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.220    266
  255.255.255.255  255.255.255.255         On-link          10.0.0.2    286
===========================================================================
Persistent Routes:
  None

3) How do I configure those users to pull a dynamic ip? I'd like to just use the same CCD file for all road warriors if possible.

Here's the CCD file I'm pushing to the VPCs (10.100.0.0/24) client/proxy:

ifconfig-push 10.0.0.2 255.255.255.0
push "route 192.168.1.0 255.255.255.0 10.0.0.1"
iroute 10.100.0.0 255.255.0.0

Here's the CCD template file I'm fiddling with for my roadwarrors (all of whom use windows to connect):

ifconfig-push 10.0.0.5 255.255.255.0
push "route 192.168.1.0 255.255.255.0 10.0.0.1"
push "route 10.100.0.0 255.255.0.0 10.0.0.2"

Here's my server config:

## HQS - Server

# local 172.20.0.1   ##May not need this?
port 1196
proto udp
dev tun
topology subnet
mode server
tls-server
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
client-to-client

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/hqs-openvpn.myco.co.crt
key /etc/openvpn/easy-rsa/keys/hqs-openvpn.myco.co.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name

server 10.0.0.0 255.255.255.0
ifconfig 10.0.0.1 255.255.255.0
#route 192.168.1.1 255.255.0.0 10.0.0.1 #HQS
route 10.100.0.0 255.255.0.0 10.0.0.2 #DEV
route 10.101.0.0 255.255.0.0 10.0.0.3 #QA
route 10.104.0.0 255.255.0.0 10.0.0.4 #PROD
client-config-dir ccd


#push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 10.0.0.0 255.255.255.0"
push "route 10.100.0.0 255.255.0.0"

keepalive 5 30
comp-lzo
persist-key
persist-tun
verb 3

user nobody
group nogroup

log-append /var/log/openvpn
status /tmp/vpn.status 10

Here's my client config (linux-based VPNs in the VPCs):

client
dev tun
proto udp
remote vpn.mycompany.co 1196
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Here's my client config (roadwarriors / windows):

client
dev tun
proto udp
remote vpn.mycomapny.co 1196 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
#tun-mtu 1500
#tun-mtu-extra 32
#mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server
#topolgy subnet

On my server, here's the output of (iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL; route -n):

root@ip-10-100-0-15:~# iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL; route -n
Chain INPUT (policy ACCEPT 22 packets, 1570 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1196

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       192.168.1.0          0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 15 packets, 1990 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1 packets, 62 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 1 packets, 62 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      eth0    10.0.0.0/24          0.0.0.0/0           
Chain PREROUTING (policy ACCEPT 22 packets, 1570 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 22 packets, 1570 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 24 packets, 3482 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 24 packets, 3482 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.100.0.1      0.0.0.0         UG    100    0        0 eth0
10.0.0.0        10.0.0.1        255.255.255.0   UG    0      0        0 tun0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.100.0.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     10.0.0.1        255.255.255.0   UG    0      0        0 tun0

On my VPC (10.100.0.0/16 network), here's the output of (iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL; route -n):

root@vpn-hqs:/etc/openvpn/ccd# iptables -vnL; iptables -t nat -vnL; iptables -t mangle -vnL; route -n
Chain INPUT (policy ACCEPT 190 packets, 347K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2926  385K ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
   12   648 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
  525 40675 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1196
    2   120 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
   24  1296 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
 1245 96055 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1196

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    5   355 ACCEPT     all  --  *      *       10.0.0.0/24          0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 627 packets, 64553 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 927 packets, 137K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 842 packets, 134K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 25 packets, 1548 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 25 packets, 1548 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 2669 packets, 677K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 2584 packets, 673K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 711 packets, 75641 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 711 packets, 75641 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.100.0.0      10.0.0.2        255.255.0.0     UG    0      0        0 tun0
10.101.0.0      10.0.0.3        255.255.0.0     UG    0      0        0 tun0
10.104.0.0      10.0.0.4        255.255.0.0     UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

maikcat

hi there,

here what i tested....

pc1 (openvpn server tun0/10.231.120.1)

pc2 (openvpn server tunserver/10.232.120.1)
pc2 (openvpn client tunsclient/10.231.120.6)

pc3 (openvpn client tun0/10.232.120.6)

ip tables used on pc2:

iptables -t nat -A POSTROUTING -o tun-client -j MASQUERADE

server config on pc2:

proto udp
port 5005
dev tun-server
ca /etc/openvpn/srvkeys/ca.crt
cert /etc/openvpn/srvkeys/server.crt
key /etc/openvpn/srvkeys/server.key
tls-auth /etc/openvpn/srvkeys/ta.key 0
dh /etc/openvpn/srvkeys/dh1024.pem
server 10.232.120.0 255.255.255.0
push "route 10.231.120.0 255.255.255.0"
keepalive 10 60
cipher AES-256-CBC
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/status.log
log /etc/openvpn/openvpn.log
verb 3
tls-cipher DHE-RSA-AES256-SHA
auth SHA1
push "explicit-exit-notify 3"

server config on pc1

proto udp
port 5005
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
tls-auth /etc/openvpn/keys/ta.key 0
dh /etc/openvpn/keys/dh1024.pem
server 10.231.120.0 255.255.255.0
keepalive 10 60
cipher AES-256-CBC
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/status.log
log /etc/openvpn/openvpn.log
verb 3
tls-cipher DHE-RSA-AES256-SHA
auth SHA1
push "explicit-exit-notify 3"

if i connect from pc3 to pc1 (via pc2) it works...
the connection seems to come from tun ip of pc2 client...

i will try to simulate your exact setup... 😐

Michael.

maikcat

i read your previous post after i posted.....

have in mind that ccd files (used in lan-to-lan scenarios) are used
to assign routes (iroute statement) so that openvpn know where to route traffic (via which client)

static ip assigment is NOT mandatory...but ccd files are TIED with common name from certificates..

if you want to try lan to lan keep in mind that you need to use route directive inside server configs
also...

allanparsons

OK. So, I think I got it. Like I said, I ended up going w/ this link (http://backreference.org/2009/11/15/openvpn-and-iroute/), since I'll have just one server to manage (located on site in my Office). All of my other networks (located at AWS) are in a series of VPCs, and I went with a flat network.

VPN Network:  10.0.0.0/24
OFFICE ENV:  192.168.1.0/24 (this will be my SERVER only)|  GW 10.0.0.1
DEV ENV (@ AWS):  10.100.0.0/16 | GW 10.0.0.2
QA ENV (@ AWS): 10.101.0.0/16 | GW 10.0.0.3
PROD ENV (@AWS): 10.104.0.0/16 | GW 10.0.0.4

To summarize, the goal is to have DEV/QA/PROD accessible from our office when RoadWarriors are connected. So, DEV/QA/PROD are acting as clients to my office server. They've been issued the GW addresses above using CCD files.

The problem, Michael, ended up being that I was assigning a gateway address (10.0.0.2) to dev. That user (dev-vpn) had a ccd file that pushed 10.0.0.2 255.255.255.0 to the client. But, I was testing/connecting via a user that didn't have a CCD file, and my SERVER was assigning me a duplicate 10.0.0.2 on my windows client (wtf!!). So, my route to DEV probably never left my local machine.

I have two final questions about my setup (at the bottom), but for everyone's benefit, figured I'd post all of my configs / scripts in the event they're trying to replicate what I've done.

SERVER/OFFICE 192.168.1.0/24

#######################################
## SERVER CONFIG (HQS / OFFICE)
#######################################


##
## server settings
##

port 11XX
proto udp
dev tun
topology subnet
mode server
tls-server
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
client-to-client
server 10.0.0.0 255.255.255.0
ifconfig 10.0.0.1 255.255.255.0


##
## cert settings (probably not needed)
##

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.crt
key /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS


##
## We assign the username as the client-cert
## forcing user/pass so we don't have to distribute
## certs.  These configs are for that.  BUT, we'll
## also need an entry for adhoc-users / employees
## in /etc/openvpn/ccd/{username}
##

client-cert-not-required
username-as-common-name
client-config-dir ccd


##
## Static routes we'll define for each of our
## Amazon VPCs
##

#dev
route 10.100.0.0 255.255.0.0 10.0.0.2 #DEV
push "route 10.100.0.0 255.255.0.0"
#qa
route 10.101.0.0 255.255.0.0 10.0.0.3 #QA
push "route 10.101.0.0 255.255.0.0"
#prod
route 10.104.0.0 255.255.0.0 10.0.0.4 #PROD
push "route 10.104.0.0 255.255.0.0"

##
## DNS Configs we'll push (google's DNS)
## Only gotcha: user may need to issue
## an ipconfig /flushdns when disconnecting
## from VPN on windows clients.
##

#push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"



## 
## Misc Settings
##

keepalive 10 60
comp-lzo
persist-key
persist-tun
max-clients 20
push "explicit-exit-notify 3"



##
## Security
##
user nobody
group nogroup



##
## Logging
##

#log-append /var/log/openvpn
verb 3
status /etc/openvpn/status.log
log /etc/openvpn/openvpn.log

AMAZON VPC | CLIENT CONFIG

client
dev tun
proto udp
remote vpn-office.mycompany.co 11XX
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

AMAZON VPC | CLIENT CONNECT SCRIPT

#!/bin/bash

mkdir -p /etc/openvpn/client/
usr="[username on server]"
config="/etc/openvpn/client/$usr.ovpn"
vpn_network=10.0.0.0
hqs_network=192.168.1.0


killall openvpn
sleep 3
touch $config
chmod 700 $config

echo $usr > /tmp/password.txt
echo [mypass] >> /tmp/password.txt

echo "" > $config
echo "client" >> $config
echo "dev tun" >> $config
echo "proto udp" >> $config
echo "remote vpn-hqs.mycompany.co 11XX" >> $config
echo "resolv-retry infinite" >> $config
echo "nobind" >> $config
#tun-mtu 1500
#tun-mtu-extra 32
#mssfix 1450
echo "persist-key" >> $config
echo "persist-tun" >> $config
echo "ca /etc/openvpn/ca.crt" >> $config
echo "auth-user-pass /tmp/password.txt" >> $config
echo "comp-lzo" >> $config
echo "verb 3" >> $config
echo "reneg-sec 0" >> $config
echo "tls-client" >> $config
echo "remote-cert-tls server" >> $config
#echo "topolgy subnet" >> $config

/usr/sbin/openvpn --config $config --daemon
sleep 5
rm -f /tmp/password.txt

iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -I INPUT -p udp --dport 11XX -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I INPUT -s $vpn_network/24 -j ACCEPT
iptables -I FORWARD -s $vpn_network/24 -j ACCEPT
iptables -I FORWARD -s $hqs_network -j ACCEPT
iptables -t nat -A POSTROUTING -s $vpn_network/24 -o eth0 -j MASQUERADE

CCD FOR DEV AMAZON VPC 10.100.0.0/16

ifconfig-push 10.0.0.2 255.255.255.0
#push "route 192.168.1.0 255.255.255.0 10.0.0.1"
iroute 10.100.0.0 255.255.0.0

CCD FOR QA AMAZON VPC 10.101.0.0/16

ifconfig-push 10.0.0.3 255.255.255.0
push "route 192.168.1.0 255.255.255.0 10.0.0.1"
iroute 10.101.0.0 255.255.0.0

CCD FOR PROD AMAZON VPC 10.104.0.0/16

ifconfig-push 10.0.0.4 255.255.255.0
push "route 192.168.1.0 255.255.255.0 10.0.0.1"
iroute 10.104.0.0 255.255.0.0

I also went ahead and created a user-create script. I did this because I couldn't figure out how to run both DHCP (for roadwarriors) and Static IPs (for my VPN clients sitting in Amazon). Here's that script:

#!/bin/sh
if [ $# -ne 2 ]
then
  echo "Usage: `basename $0` [add|delete] username"
  echo "   example:  `basename $0` mycompanyuser"
  exit
fi

action=$1
username=`echo $2 |awk '{print tolower($0)}'`
ccddir=/etc/openvpn/ccd

##
## delete user
##
if [ "$action" = "delete" ]; then
        userdel -f $username
        rm -f $ccddir/$username
        echo "User Deleted! [username: $username]"
        exit;
fi


##
## Make sure the user doesn't already exist
##
if [ `cat /etc/passwd | grep -i $username | wc -l` -ne 0 ] ; then
	echo "ERROR.  $username already exists!"
	exit 0;
fi

##
## Check for existence of makepasswd
##
if [ `which makepasswd | wc -l` -eq 0 ] ; then
	echo "ERROR.  Command makepasswd does not exist!"
	exit 0;
fi

##
## Check that params are correct
##
if [ `echo $action | grep -E 'add|delete' | wc -l` -eq 0 ]; then
	echo "ERROR! Invalid Option.  Options Accepted:  add, delete"
	echo ""
	exit 0
fi


##
## GET THE NEXT IP TO ISSUE
##
MaxValue=255
topip=`grep "ifconfig-push" $ccddir/* | awk '{print $2}' | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | tail -n 1`
baseaddr="$(echo $topip | cut -d. -f1-3)"
lsv="$(echo $topip | cut -d. -f4)"
if [ $lsv -eq $MaxValue ] ; then
	echo "edge case needs to be written"
	exit
fi
nextip=`expr $lsv + 1`
ip="$baseaddr.$nextip"

##
## create the user
##
read -s -p "Enter User Password (ENTER to automatically assign a password): " userPassword
if [ -z $userPassword ]; then
	passIn=$(makepasswd --char=8)
	pwout=$userPassword
else
	passIn=`echo $userPassword | openssl passwd -1 -stdin`
	pwout="HIDDEN"
fi
useradd $username -p $passIn -s /bin/false


##
## write the user's vpn file
##
echo "ifconfig-push $ip 255.255.255.0" > $ccddir/$username

##
## confirm account creation
##
if [ `cat /etc/passwd | grep -i $username | wc -l` -eq 1 ]; then
	echo ""
	echo "USER ADDED!"
	echo "------------------------------------------------"
	echo "USER:  $username"
	echo "PASSWORD:  $pwout"
	echo "IP:  $ip"
	echo "CONTENTS OF CCD FILE:"
	cat $ccddir/$username
	echo ""
	echo "------------------------------------------------"
	echo ""
fi

exit 0

To launch:
- Bring the SERVER up.
- Add users using the script provided (supports add/delete functionality)
- Bring the Amazon Clients up using the scripts provided and the users added in the step above.

MY QUESTIONS

1) How can I assign users / roadwarriors ips via DHCP, yet assign my Amazon VPC VPN clients STATIC Ips?
2) I want to lock certain users out of certain VPCs (i.e. some users shouldnt be able to access my PROD VPC on 10.104.0.0/16). How can I do this through CCD files? I'm ok (if it's possible) to just not push routes to them...
3) What iptable rules do I need to add so that 80/443 traffic doesn't go through my Office VPN so when users are at home away from the office, they use their own internet for browsing?

Thanks for all of your help fellas. I feel stupid that it was because my VPC VPN client was assigned the same IP as my Windows RoadWarrior client.

maikcat

hi there,

1) How can I assign users / roadwarriors ips via DHCP, yet assign my Amazon VPC VPN clients STATIC Ips?

the openvpn dhcp gives away ip used from the beggining of the scope ,with that in mind
you can create a mixed enviroment considering to assign ips statically taken from the end of ip scope...
the above works as long as you DONT use ccd-exclusive directive..

2) I want to lock certain users out of certain VPCs (i.e. some users shouldnt be able to access my PROD VPC on 10.104.0.0/16). How can I do this through CCD files? I'm ok (if it's possible) to just not push routes to them...

you can add push routes that everybody needs in your main config and add to to your ccd files
ONLY which ones you do want your clients to have...

also take a look on push-reset directive (placed inside ccd file)

3) What iptable rules do I need to add so that 80/443 traffic doesn't go through my Office VPN so when users are at home away from the office, they use their own internet for browsing?

add ip tables..? where? on your server? then the traffic would already left the client via vpn tunnel...
i believe it would be simplier if your are NOT using redirect-gateway...

Hope i helped

regards,

Michael.