Hi guys, I have trawled the forums and google seeking an answer to this but I am at a loss. Hopefully you can help!! I have a working OpenVPN setup with various clients (each with unique certificates) connecting to an internet facing OpenVPN server. Some of these clients access this box via proxy server and some connect directly (TCP:443). All clients seem to work just fine and receive an IP address in the default 10.8.0.0/24 network. They can all ping each other. My challenge is that I want all off these clients to speak with a network that is sat behind one of these clients (Server 2008 x64)... ...we need to do this without adjusting the routing setup of said network. In this case I believe that NAT is required? Please see this diagram which i have attempted to reference (I hope that works!) [img]http://derp.co.uk/ee000[/img] [url]http://derp.co.uk/ee000[/url] How can I go about this please? What would such functionality even be called!? I have enabled IP forwarding on both the OpenVPN server (Fedora) and the Windows server client in question. I have also installed and configured Routing and Remote Access services on the Windows Server. My server configuration file is as follows... [b]##--grep -v -e "^[#;]" server.conf|grep -v -e "^$" port 443 proto tcp dev tun ca /root/easy-rsa/keys/ca.crt cert /root/easy-rsa/keys/server.crt key /root/easy-rsa/keys/server.key # This file should be kept secret dh /root/easy-rsa/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-config-dir ccd route 10.102.102.0 255.255.255.0 client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 [/b] The configuration file for the client that will need to NAT for the network in question is as follows... [b]# grep -v -e "^[#;]" client.conf|grep -v -e "^$" client dev tun proto tcp remote XXXXXXXX.com 443 resolv-retry infinite nobind persist-key persist-tun http-proxy-retry http-proxy 172.29.XXX.80 8080 ca C:\\Program\ Files\\OpenVPN\\keys\\ca.crt cert C:\\Program\ Files\\OpenVPN\\keys\\client1.crt key C:\\Program\ Files\\OpenVPN\\keys\\client1.key ns-cert-type server comp-lzo verb 3 [/b] Please can anyone help please? I have played with routes on the server and attempted to direct traffic for the 10.102.102.0 network down to the client... [b]route add 10.102.102.0 tun0[/b] [b]route add -net 10.102.102.0 netmask 255.255.255.0 gw 10.8.0.26[/b] Nothing seems to be working for me. Any ideas!?

OpenVPN Reverse Client NAT...?

elluk

Hi guys,

I have trawled the forums and google seeking an answer to this but I am at a loss. Hopefully you can help!!

I have a working OpenVPN setup with various clients (each with unique certificates) connecting to an internet facing OpenVPN server.
Some of these clients access this box via proxy server and some connect directly (TCP:443).
All clients seem to work just fine and receive an IP address in the default 10.8.0.0/24 network. They can all ping each other.

My challenge is that I want all off these clients to speak with a network that is sat behind one of these clients (Server 2008 x64)...
...we need to do this without adjusting the routing setup of said network. In this case I believe that NAT is required?

Please see this diagram which i have attempted to reference (I hope that works!)

http://derp.co.uk/ee000

How can I go about this please? What would such functionality even be called!?

I have enabled IP forwarding on both the OpenVPN server (Fedora) and the Windows server client in question.
I have also installed and configured Routing and Remote Access services on the Windows Server.

My server configuration file is as follows...
##--grep -v -e "^[#;]" server.conf|grep -v -e "^$"
port 443
proto tcp
dev tun
ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/server.crt
key /root/easy-rsa/keys/server.key # This file should be kept secret
dh /root/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.102.102.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

The configuration file for the client that will need to NAT for the network in question is as follows...
# grep -v -e "^[#;]" client.conf|grep -v -e "^$"
client
dev tun
proto tcp
remote XXXXXXXX.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
http-proxy-retry
http-proxy 172.29.XXX.80 8080
ca C:\\Program\ Files\\OpenVPN\\keys\\ca.crt
cert C:\\Program\ Files\\OpenVPN\\keys\\client1.crt
key C:\\Program\ Files\\OpenVPN\\keys\\client1.key
ns-cert-type server
comp-lzo
verb 3

Please can anyone help please?

I have played with routes on the server and attempted to direct traffic for the 10.102.102.0 network down to the client...
route add 10.102.102.0 tun0
route add -net 10.102.102.0 netmask 255.255.255.0 gw 10.8.0.26

Nothing seems to be working for me. Any ideas!?

maikcat

please use this as your server config:

port 443
proto tcp
dev tun
ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/server.crt
key /root/easy-rsa/keys/server.key # This file should be kept secret
dh /root/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "route 10.102.102.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

also if your lan interface on your defora is eth0 , also run this on vpn server itself:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

tip,for striping comments on your configs you can as well use this:

grep -vE '^#|^;|^$' /etc/openvpn/openvpn.conf

😉

elluk

Thanks maikcat. Still no joy i'm afraid to say. :cry:

This stopped the Windows server from communicating with the 10.102 network itself - I guess because it collected that route from the VPN config.
I had to delete that route on the windows box and correct the table to use the suitable interface.
route delete 10.102.102.0 mask 255.255.255.0 10.8.0.25

Wireshark is showing nothing on the Server 2008 TUN adapter when i try and ping the 10.102 range from the OpenVPN server. Almost like the packets don't get there?
All clients can still connect to VPN at this stage and ping each other via the 10.8 addresses - these requests can be seen in Wireshark without a problem.

A traceroute to 10.102.102.1 on the OpenVPN server sent traffic internet bound to start with.
I have now passed this out via the tun interface but the traceroute shows nothing...
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default gw2.vps.coolhou 0.0.0.0 UG 0 0 0 eth0
default gw2.vps.coolhou 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.102.102.0 * 255.255.255.255 UH 0 0 0 tun0
10.102.102.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
89.187.144.0 * 255.255.254.0 U 0 0 0 eth0
[root@reinforce ~]# traceroute 10.102.102.1
traceroute to 10.102.102.1 (10.102.102.1), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 *^C

Any ideas? I am really stuck.

Thanks!!

Elliott

maikcat

my bad... sorry

i just read your config more closely...

you want to access pcs BEHIND your client (10.8.0.26)..

my bad..

your client with .26 ip is windows 2008?

you still have to create a ccd file named after the cert your client uses with the following

iroute 10.102.102.0 255.255.255.0

reenable the route statement on your server config

port 443
proto tcp
dev tun
ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/server.crt
key /root/easy-rsa/keys/server.key # This file should be kept secret
dh /root/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.102.102.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

and remove the nat rule i gave you before..

Michael

elluk

AWESOME!! That's done it. 😃 The VPN server can speak to the Windows Servers LAN as desired.

I could see packets destined for 10.102 coming down the VPN once I made that iroute change.
The moment I enabled the Windows Routing and Remote Access NAT everything flowed through.

THANK YOU MICHAEL!

The iroute setting for that client was the key. As you no doubt figured.

iroute 10.102.102.0 255.255.255.0

What is this functionality refereed to as?

The only outstanding piece is to fix up routes on other clients. I did this manually on one of them...

route add 10.102.102.0 mask 255.255.255.0 10.8.0.5

And that fixed it. So.... how do I go about sending that route to all other clients apart from the Windows server?

...I have placed a file for each client into ccd containing the following:

push "route 10.102.102.0 255.255.255.0"

This seems to have done the job... is that the correct approach?

Thanks again for your help Michael. Sorry for the trouble.

I have only been using OpenVPN for a couple of days - VERY IMPRESSED WITH IT!

Elliott.

maikcat

about iroute...

--iroute network [netmask]
Generate an internal route to a specific client. The netmask parameter, if omit‐
ted, defaults to 255.255.255.255.

This directive can be used to route a fixed subnet from the server to a particular
client, regardless of where the client is connecting from. Remember that you must
also add the route to the system routing table as well (such as by using the
--route directive). The reason why two routes are needed is that the --route
directive routes the packet from the kernel to OpenVPN. Once in OpenVPN, the
--iroute directive routes to the specific client.

This option must be specified either in a client instance config file using
--client-config-dir or dynamically generated using a --client-connect script.

The --iroute directive also has an important interaction with --push "route ...".
--iroute essentially defines a subnet which is owned by a particular client (we
will call this client A). If you would like other clients to be able to reach A's
subnet, you can use --push "route ..." together with --client-to-client to effect
this. In order for all clients to see A's subnet, OpenVPN must push this route to
all clients EXCEPT for A, since the subnet is already owned by A. OpenVPN accom‐
plishes this by not not pushing a route to a client if it matches one of the
client's iroutes.

This seems to have done the job... is that the correct approach?

alternatively you could add the push route statement into server config so this
route will propagate to *every* client that connects..

Glad i've helped you out... 🙂

Michael.