OpenVPN Default GW

FireDragon

Hello,

i´ve an OpenVPN Server that runs on an OpenSuse Based System.
The Problem is, that the pushed gateway is everey time the the address from the OpenVpn Server.

The network injection was realized with bridged Interfaces and TAP

The Server has the ip 172.17.30.2

The default Gateway for the Client should be 172.17.30.1.

push "route-gateway 172.17.30.1" dont work

The Server still push the IP 172.17.30.2 as default gw to the client.

Can somebody help me, please ?

The Serverconf:

port 1194
proto udp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server-bridge 172.17.30.2 255.255.255.0 172.17.30.30 172.17.30.80
push "dhcp-option DNS 10.1.30.30"
push "dhcp-option DNS 10.1.30.31"
client-config-dir /etc/openvpn/server-clients
push "route-gateway 172.17.30.1"
push "route 0.0.0.0 0.0.0.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 5
mute 20

Client Conf:

client
remote 193.197.157.168 1194
dev tap0
proto udp
ca /etc/openvpn/ca.crt
cert /etc/openvpn/birkenwald.crt
key /etc/openvpn/birkenwald.key
ns-cert-type server
comp-lzo
persist-key
persist-tun
float
pull
log /var/log/openvpn.log
verb 5
resolv-retry infinite

FireDragon

Thank you for your answer.

I changed the bridge-server to the gw.

The client, has now the default gw 172.17.30.1.

The traffic to the server 172.17.30.2 is working. But the traffic to the default gw doesnt.

On the Server everything is working fine.

Do you have an idea ?

My routing table after connect to the Server looks like that on the client:

route -n
Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 172.17.30.1 0.0.0.0 UG 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
172.17.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.17.30.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
172.17.30.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
193.197.157.168 172.17.1.1 255.255.255.255 UGH 0 0 0 eth0

My bridge-start config on client:

br="br0"
tap="tap0"
openvpn --mktun --dev $tap
ifconfig $tap 0.0.0.0 promisc up
eth="eth1"
eth_ip="172.17.30.10"
eth_netmask="255.255.255.0"
eth_broadcast="172.17.30.255"
brctl addbr $br
brctl addif $br $tap
brctl addif $br $eth
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

And the ifconfig looks like this:

br0 Link encap:Ethernet Hardware Adresse 00:24:21:0C:89:BF
inet Adresse:172.17.30.10 Bcast:172.17.30.255 Maske:255.255.255.0
inet6 Adresse: fe80::224:21ff:fe0c:89bf/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:325 errors:0 dropped:0 overruns:0 frame:0
TX packets:39 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 Sendewarteschlangenlänge:0
RX bytes:16250 (15.8 Kb) TX bytes:1878 (1.8 Kb)

eth0 Link encap:Ethernet Hardware Adresse 00:03:47:B1:07:4E
inet Adresse:172.17.1.36 Bcast:172.17.1.255 Maske:255.255.255.0
inet6 Adresse: fe80::203:47ff:feb1:74e/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1553291 errors:0 dropped:0 overruns:0 frame:0
TX packets:839016 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 Sendewarteschlangenlänge:1000
RX bytes:189314201 (180.5 Mb) TX bytes:91869431 (87.6 Mb)

eth1 Link encap:Ethernet Hardware Adresse 00:24:21:0C:89:BF
UP BROADCAST PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 Sendewarteschlangenlänge:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:18

lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
inet6 Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:2351 errors:0 dropped:0 overruns:0 frame:0
TX packets:2351 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 Sendewarteschlangenlänge:0
RX bytes:246677 (240.8 Kb) TX bytes:246677 (240.8 Kb)

tap0 Link encap:Ethernet Hardware Adresse 76:D4:E8:B6:86:F2
inet Adresse:172.17.30.30 Bcast:172.17.30.255 Maske:255.255.255.0
inet6 Adresse: fe80::74d4:e8ff:feb6:86f2/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:325 errors:0 dropped:0 overruns:0 frame:0
TX packets:44 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 Sendewarteschlangenlänge:100
RX bytes:20800 (20.3 Kb) TX bytes:2356 (2.3 Kb)

FireDragon

Yes i have enabled the Ip forwarding on the Server.

But througt the bridge, the packages run directly to the network over the GW without going throught the vpn Server isnt it ?

FireDragon

oh ok. i´ve tested the redirect gateway with def1 a couples of days ago. But there was my server-bridge setting wrong.
Now is the settings you recommended are done.

But the ping oder anything else from the client over the default gw dont work =/.

The Firewall settings should be OK. I use an Juniper Netscreen. And on the server all works perfectly.

FireDragon

Okay here are my Logs from the Server and Client. But a new Problem is now in the configuration. I've got now 2 GW here is my routing table.
Thank you very much for your help and time.

Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 172.17.30.1 128.0.0.0 UG 0 0 0 br0
0.0.0.0 172.17.1.1 0.0.0.0 UG 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
128.0.0.0 172.17.30.1 128.0.0.0 UG 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
172.17.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.17.30.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
172.17.30.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
193.197.157.168 172.17.1.1 255.255.255.255 UGH 0 0 0 eth0

The Server log:

http://textuploader.com/?p=6&id=XmsLu

Server.conf:

local 172.17.30.2
port 1194
proto udp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server-bridge 172.17.30.1 255.255.255.0 172.17.30.30 172.17.30.80
push "dhcp-option DNS 10.1.30.30"
push "dhcp-option DNS 10.1.30.31"
client-config-dir /etc/openvpn/server-clients
push "redirect-gateway def1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 6
mute 20

The ClientServerconf:

grep -vE '^#|^;|^$' /etc/openvpn/server-clients/birkenwald
ifconfig-push 172.17.30.30 255.255.255.0
push "dhcp-option DNS 10.1.30.30 10.1.30.31"

Bridge-start on Server:

br="br0"
tap="tap0"
eth="eth0"
eth_ip="172.17.30.2"
eth_netmask="255.255.255.0"
eth_broadcast="172.17.30.255"
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
sysctl -w net.ipv4.ip_forward=1
route add -net 0.0.0.0 gw 172.17.30.1 netmask 0.0.0.0 br0

The Client Log:

http://txtup.co/8aSb9

The Client.conf:

client
remote 193.197.157.168 1194
dev tap0
proto udp
ca /etc/openvpn/ca.crt
cert /etc/openvpn/birkenwald.crt
key /etc/openvpn/birkenwald.key
ns-cert-type server
comp-lzo
persist-key
persist-tun
float
pull
log /var/log/openvpn.log
verb 6
resolv-retry infinite

Brdige-start on Client:

br="br0"
tap="tap0"
openvpn --mktun --dev $tap
ifconfig $tap 0.0.0.0 promisc up
eth="eth1"
eth_ip="172.17.30.30"
eth_netmask="255.255.255.0"
eth_broadcast="172.17.30.255"
brctl addbr $br
brctl addif $br $tap
brctl addif $br $eth
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
sysctl -w net.ipv4.ip_forward=1