Internet traffic NOT trought the vpn... how to ?

GbMax78

I have a Debian Wheezy+OpenVPN, openssl 128, tun, etc.

Remotely I can see my lan but I need to surf on internet by my remote wan ip not by my local vpn server ip, how can I modify my server.conf ?

Best regards.
GbMax78 🙂

maikcat

post your configs first...

Michael.

GbMax78

Thank you for your fast reply ! 🙂

maikcat wrotepost your configs first...

local 192.168.1.251
port 1194
proto udp
dev tun
ca ca.crt
cert server01.crt
key server01.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.8.0.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
max-clients 3
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

i edited your config 😉

2 things are needed...

1) add this to your server config:

push "redirect-gateway def1"

2) enable nat on traffic originating vpn going out on eth0 interface

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Michael.

GbMax78

maikcat wrotei edited your config 😉

2 things are needed...

1) add this to your server config:

push "redirect-gateway def1"

I followed sample file (server.conf) and I found

push "redirect-gateway def1 bypass-dhcp"

not only

push "redirect-gateway def1"

so I used the first one with dhcp and it work ![/color]

maikcat wrote 2) enable nat on traffic originating vpn going out on eth0 interface

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Michael.

I already have in my /etc/rc.local
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Thank you very much ! 🙂