Difficulty setting up openvpn routing

akandi

Hi
I'm trying to set up an OpenVpn tunnel. The client connects just fine, but I can't reach anything in the remote Lan nor the internet through the tunnel.

Let's call the Lan where the server is located Lan1 and the one where my client is currently located Lan2.
Both Lan1 and Lan2 run on the 192.168.1.0/24 subnet. However I have no intention of accessing Lan2 from Lan1.
The subnet used by OpenVpn is 10.8.0.0/24.
Lan1 is behind a router sitting at 192.168.1.100 and the OpenVpn server's sitting at 192.168.1.105.
Lan2 has a router sitting at 192.168.1.1.

That's what my client config looks like:

client
dev tun
proto udp
remote ##.##.##.## 1294
resolv-retry infinite
nobind
persist-key
persist-tun
ca [inline]
cert [inline]
key [inline]
ns-cert-type server
tls-auth [inline]
key-direction 1
cipher AES-256-CBC
pull
comp-lzo
verb 3

# followed by all the inline keys and certificates

And my server config:

port 1294
proto udp
dev tun
ca /home/andi/openvpn/ca.crt
cert /home/andi/openvpn/server.crt
key /home/andi/openvpn/server.key
dh /home/andi/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 77.109.138.45"
push "dhcp-option DNS 77.109.139.29"
keepalive 10 120
tls-auth /home/andi/openvpn/ta.key 0
cipher AES-256-CBC
comp-lzo
max-clients 3
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3

I've added the following iptables rules on the server machine
-I FORWARD -i tun+ -o eth0 -s 10.8.0.0/24 -m conntrack --cstate NEW -j ACCEPT
-I FORWARD -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT

On the router of Lan1 I've forwarded the port (1294) and added a static route 10.8.0.0/24 to 192.168.1.105.

I've already tried it with and without the bypass-dhcp flag, pushing routes from 192.168.1.0/24 to 192.168.1.100 with and without a single route preserving 192.168.1.1.
I've also tried just forwarding everything between tun0 and eth0

The ufw log shows lots of packets originating from tun0 like
[ 8847.331492] [UFW ALLOW] IN=tun0 OUT=eth0 MAC= SRC=10.8.0.6 DST=87.118.85.241 LEN=63 TOS=0x00 PREC=0x00 TTL=127 ID=2959 PROTO=UDP SPT=56882 DPT=53 LEN=43
but none going there.

Can someone please help me get this working.
I'm new to this whole thing and don't really know how to pinpoint the problem here.

Thanks
Andy

maikcat

first verify that your client updates its routing table after vpn is up,
enable NAT on your openvpn server
enable ip forwarding on your openvpn server

Michael.

akandi

Thanks for your answers.
The routes on the client side get added just fine.
I don't really want to change the subnet of LAN1 since it's not my personal LAN and I don't want to break anybodys NAS or whatever.
I can change the subnet of LAN2, though, and I'm going to do that tonight when I get home in hope that it'll facilitate testing.
I've changes my iptables rules to the following:
-I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -j ACCEPT
-I FORWARD -i eth0 -o tun0 -d 10.8.0.0/24 -j ACCEPT
-t nat -I POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

What I just found with the old firewall rules as well as the new ones is that after enabling the firewall with these rules and running openvpn server I can't even access the internet anymore from my server (ping google.com).
That doesn't make sense to me since these rules all have either the -s or -d flag set to only apply for the VPN subnet.
But it really makes me suspect a firewall config problem on the server side to be cause for my problem.

akandi

I forgot to mention IPv4 forwarding is enabled on the server.

akandi

I just managed to get it working by throwing out UFW altogether. Currently I only have the rules in my second post set in iptables, allowing everything else (which I'll change eventually, but it's not that pressing since the server is behind a router).
What I'd like to know, though, is if I can do this entire setup without the NAT rule.
Shouldn't having the static route 10.8.0.0/24->192.168.1.105 set on the router be enough? The hosts in LAN1 would just send packets addressed to 10.8.0.0/24 to the router, which then would reroute them to 192.168.1.105.
What's the speed penalty of using NAT vs routing everything through the router?

I'm getting roughly 2.5 Mbit/s throughput using Ubuntu Server running nothing but OpenVPN and OpenSSH on a machine with specs comparable to current desktop PCs. Is this normal? What can I do to increase this. The uplink speed at both endpoints is at least 10 Mbit/s or more.