Found the solution with NAT
Just checked if /etc/sysctl.conf on my Turnkey Ovpn Client machine had forwarding enabled
net.ipv4.ip_forward = 1
it was by default.
Separated LAN ip pool from tunnel ip pool like LAN is 10.144.x.x Tunnel is 10.154.x.x
Enabled NAT on tun0 interface of Turnkey Ovpn Client
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
did not know how to do this properly and inserted it as boot up action
server config on VPS Turnkey Opvn Gateway
- # PUBLIC_ADDRESS: xx.xx.xx.xx (used by openvpn-addclient)
port xxxx
proto udp
dev tun
comp-lzo
keepalive 10 120
persist-key
persist-tun
user nobody
group nogroup
chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt
ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir /etc/openvpn/server.ccd
status /var/log/openvpn/server.log
verb 4
# virtual subnet unique for openvpn to draw client addresses from
# the server will be configured with x.x.x.1
# important: must not be used on your network
server 10.161.12.0 255.255.255.0
# configure clients to route all their traffic through the vpn
push "redirect-gateway def1 bypass-dhcp"
client config on Turnkey Ovpn Client
- remote xx.xx.xx.xx port
proto udp
ns-cert-type server
client
dev tun
resolv-retry infinite
keepalive 10 120
nobind
comp-lzo
verb 3
;user nobody
;group nogroup
<ca>
-----BEGIN CERTIFICATE-----
certificate code here
-----END CERTIFICATE-----
</ca>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
key code here
-----END OpenVPN Static key V1-----
</tls-auth>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 6 (0x6)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=CA, L=San Francisco, O=TurnKey Linux, OU=OpenVPN, CN=server/name=openvpn/emailAddress=admin@your.net
Validity
Not Before: Jul 5 09:53:54 2014 GMT
Not After : Jul 2 09:53:54 2024 GMT
Subject: C=US, ST=CA, L=San Francisco, O=TurnKey Linux, OU=OpenVPN, CN=gwclnt/name=openvpn/emailAddress=gwclnt@your.net
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
key code here
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
key ident here
X509v3 Authority Key Identifier:
keyid:key id here
DirName:/C=US/ST=CA/L=San Francisco/O=TurnKey Linux/OU=OpenVPN/CN=server/name=openvpn/emailAddress=admin@your.net
serial:serial here
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha1WithRSAEncryption
signature code here
-----BEGIN CERTIFICATE-----
certificate code here
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
key code here
-----END PRIVATE KEY-----
</key>
