Does Openvpn security go out the window when accross a LAN?

smokingwheels

Hi I have a media server running with openVPN on my LAN and I have just discovered that I do not need a client to connect to my Shoutcast server bound on the OpenVPN server ip.
Is this correct?

If my memory serves me correct when first setup, I cant connect to Shoutcast with out a client connection first.

I am running win 2000 pro with ICS and openvpn version 2.2.0 I know its out of date and the new version wont work.

I also need to remotely connect over the net as well.

My server config

port 1194
proto udp
dev tap
dev-node "Local Area Connection 3"
ca ca.crt
cert server0.crt
key server0.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt
duplicate-cn
keepalive 10 120
tls-auth ta.key 0
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 4

Shoutcast 1.9.x config
SrcIP=127.0.0.1
DestIP=10.0.4.1

Thanks in advance

mwandelaar

Hi I have a media server running with openVPN on my LAN and I have just discovered that I do not need a client to connect to my Shoutcast server bound on the OpenVPN server ip.
Is this correct?

If the shoutcast-server is inside your lan, this is correct. You don't need vpn or whatever for a local LAN-connection.
It's perfect possible to create a openVPN-connection across the LAN and connect to services on VPN-ip-addresses. This has no security-drawbacks.
It only depends on your setup, so please provide more info about your local network-setup.

smokingwheels

mwandelaar wrote
Hi I have a media server running with openVPN on my LAN and I have just discovered that I do not need a client to connect to my Shoutcast server bound on the OpenVPN server ip.
Is this correct?
If the shoutcast-server is inside your lan, this is correct. You don't need vpn or whatever for a local LAN-connection.
It's perfect possible to create a openVPN-connection across the LAN and connect to services on VPN-ip-addresses. This has no security-drawbacks.
It only depends on your setup, so please provide more info about your local network-setup.

Thankyou for the reply, I am not very good at explaining things.
The main idea of using a vpn connection over the internal lan is if I setup a media server on a network I could denies access to streams not suitable for children's PS's.

My shoutcast server ip is bound and is listening on my openvpn server ip port 8xxx not on the ip of my lan.
I have a Belkin Surf Wireless router with the modem port plugged into my ICS PC lan card, I share the usb dongle on this pc to provide internet connectivity.
The other PC's connect to the Belkin device with cable or wireless.
The internet sharer has ip 192.168.0.1 with dhcp the router I think passes it on.

mwandelaar

My shoutcast server ip is bound and is listening on my openvpn server ip port 8xxx not on the ip of my lan.
I have a Belkin Surf Wireless router with the modem port plugged into my ICS PC lan card, I share the usb dongle on this pc to provide internet connectivity.
The other PC's connect to the Belkin device with cable or wireless.
The internet sharer has ip 192.168.0.1 with dhcp the router I think passes it on.

OK, this makes it more clear, allthough i have some thoughts here:

My server config

port 1194
proto udp
dev tap

This tells me you are using ethernet-bridging. What is the actual ip, bound to the tap-interface?

- If it has an ip-address inside the lan-range, the ICS will ethernet-bridge the packets for you.

- If it has an ip-address inside another range (i think you are using 10.4.0.1 for this) how are the firewall-rules on the ICS machine? Does it block traffic or is it routing?

Shoutcast 1.9.x config
SrcIP=127.0.0.1
DestIP=10.0.4.1

Shouldn't this be the otherway around? Bind to the 10.4.0.1 interface and dest the VPN-net? I'm not really familiair with configuring Shoutcast.

smokingwheels

mwandelaar wrote
My shoutcast server ip is bound and is listening on my openvpn server ip port 8xxx not on the ip of my lan.
I have a Belkin Surf Wireless router with the modem port plugged into my ICS PC lan card, I share the usb dongle on this pc to provide internet connectivity.
The other PC's connect to the Belkin device with cable or wireless.
The internet sharer has ip 192.168.0.1 with dhcp the router I think passes it on.
OK, this makes it more clear, allthough i have some thoughts here:
My server config

port 1194
proto udp
dev tap
This tells me you are using ethernet-bridging. What is the actual ip, bound to the tap-interface?
- If it has an ip-address inside the lan-range, the ICS will ethernet-bridge the packets for you.

- If it has an ip-address inside another range (i think you are using 10.4.0.1 for this) how are the firewall-rules on the ICS machine? Does it block traffic or is it routing?
Shoutcast 1.9.x config
SrcIP=127.0.0.1
DestIP=10.0.4.1
Shouldn't this be the otherway around? Bind to the 10.4.0.1 interface and dest the VPN-net? I'm not really familiair with configuring Shoutcast.

My win 2000 ICS machine has lan ip of 192.168.0.1 with DHCP
My Tap interface is 10.0.4.1

As far as I can tell the ICS machine has no firewall or blocking adjustments you can only add services with port number I even tried forwarding UPD 1194 to 10.0.4.1 no blocking of traffic. Normally I don't think one would share a USB Dongle across an internal network though. I think it just must route the traffic thru.

 Shoutcast
SrcIP=127.0.0.1   Is the ip that shoutcast listens on eg receiver ip because it is internal then the machine its running on is the only source via a plugin in winamp. Winamp is a free MP3 player but with the Winamp Pro version you can broadcast your public or private radio station via a plugin with shoutcast.

DestIP=10.0.4.1   This is the shoutcast broadcast ip which anyone can connect eg a OpenVPN Client over the net or internal Lan.

smokingwheels

Update:
I have turned the media server connection around just to test.
I have openvpn server tap interface 10.0.3.1 and connect from ICS computer.
There is no Media services available until I connect to lan ip 192.168.0.55 assigned by the DHCP.

So my media server system to blocking unneeded channels can not be blocked on a ICS PC.
I am using openvpn version 2.2.2.

smokingwheels

More info

When you have openvpn server on the same PC you don't need a client to connect to a service ip and port.

This would shed some light on my ICS problem because the traffic is coming down the gateway 192.168.0.1 to 10.0.4.1.

mwandelaar

The only thing left here (as i can see) is testing if you can connect to other lan-based services, via a vpn-connection. For example a webserver on the vpn-server, in this case the ICS machine. Or more low-level, just ping traffic from vpn-client to the vpn-server.

If so, the vpn-connection is not the problem anymore and you might have to take a look to some routing-issues or so.

smokingwheels

Update...
When you have a adsl modem it does not happen..A normal internet connection.