MadsRC
I recently made the move to OpenVPN and have been extremely happy.
My current setup is this:
WAN -> LAN (192.168.1.0/24) -> VPN Network (10.8.0.0/8)
OpenVPN is installed on a server on my LAN and is not the device that routes LAN to WAN.
My OpenVPN server has the IP of 192.168.1.253/24 and is Ubuntu 12.04.03.
On my router i have made a static route to route all traffic bound for 10.8.0.0/8 to 19.168.1.253 and on the OpenVPN router I have enabled IP forwarding and my iptables is default, except for this rule:
-A POSTROUTING -o eth0 -j MASQUERADE
This all works fine and dandy, but the real problem is that I have a NFS server where I'd like to limit some of the shares. As you know with NFS, authorization is done on IP's.
Problem is that when a client (say 10.8.0.6) connects to the NFS share (192.168.1.100:/mnt/share), the NFS server (192.168.1.100) only sees a request comming from 192.168.1.253 (As it is masqueraded).
This severly limits my NFS authentication, asn I can mount a share where I have specifically dissalowed the VPN subnet.
If I remove the masquerade rule from the VPN server, the NFS server sees the correct IP from my VPN clients and can therefore block the ones I'd like to block. But my clients then can't browse the internet.
Is there any way I can make the clients traffic reach the WAN AND not NAT/masquerade their IP's so my NFS share can block them?
I hope my explanation was clear enough, if it wasn't, please feel free to tell me what more you'd like to know.
UncleBob
So your clients are able to see your LAN, but not the Internet? Did you allow traffic from/to 10.8.0.0 through your Internet gate?
MadsRC
Yes, that is correct. My clients can browse the LAN and not the Internet unless I use masquerading, which I don't want to for reasons specified in the original post.
I just checked my internet gate/gateway and in it routing table it has:
10.8.0.0 255.255.255.0 192.168.1.253 LAN & WLAN
A quick ping from a host on my LAN subnet to a connected VPN client (From 192.168.1.249 to 10.8.0.6):
PING 10.8.0.6 (10.42.0.6): 56 data bytes
64 bytes from 10.8.0.6: icmp_seq=0 ttl=63 time=20.549 ms
92 bytes from 192.168.1.1: Redirect Host(New addr: 192.168.1.253)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 3296 0 0000 3f 01 5342 192.168.1.249 10.8.0.6
64 bytes from 10.8.0.6: icmp_seq=1 ttl=63 time=28.438 ms
64 bytes from 10.8.0.6: icmp_seq=2 ttl=63 time=72.752 ms
64 bytes from 10.8.0.6: icmp_seq=3 ttl=63 time=114.969 ms
64 bytes from 10.8.0.6: icmp_seq=4 ttl=63 time=52.945 ms
64 bytes from 10.8.0.6: icmp_seq=5 ttl=63 time=15.368 ms
64 bytes from 10.8.0.6: icmp_seq=6 ttl=63 time=13.884 ms
64 bytes from 10.8.0.6: icmp_seq=7 ttl=63 time=79.144 ms
--- 10.8.0.6 ping statistics ---
8 packets transmitted, 8 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 13.884/49.756/114.969/34.337 ms
The above shows that the gateway has a viable route and that packets can move from my LAN to my VPN network and back.
UncleBob
Hi,
I was rather talking about the firewall at your LAN gateway, not routing. Do you have one and is it configured to allow traffic from 10.8.0.0 subnet?
