Client IP Address Incorrect - NAT Configuration

jasondharper

I'm using OpenVPN in a NAT configuration as follows:

OPENVPN Server (Single NIC)
eth0: 10.100.0.11 (NAT'ed to public IP 54.221.x.x)

Internal Network: 10.100.0.0/22

OpenVPN Client Network: 10.200.0.0/29

When a client connects to the VPN, they're assigned a 10.200.0.6 address (all good). I am able to ping the VPN (internal address) server no issues. I had created rules in my network to allow traffic to various hosts to/from 10.200.0.0/29. However, it appears that the client is actually using an internal IP 10.100.0.0/22 on the inside of the network.

My question is this....how can I have the client's source be a 10.200.0.0/29 address all the way through the network? This is important because we're creating security rules around where a VPN client can go.

Thank you!

SERVER.CONF
=========

local 10.100.0.11
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.200.0.0 255.255.255.248
ifconfig-pool-persist ipp.txt
push "route 10.100.0.0 255.255.254.0"
push "route 10.100.2.0 255.255.254.0"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun

CLIENT.CONF
=========

client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo

maikcat

please post the output of:

iptables -L -v -t nat
iptables -L -v

on your openvpn server

Michael.

jasondharper

Hello,

Thanks for the reply! The output of both commands is below. I do have iptables disabled so I'm guessing that's why everything here is blank.

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

maikcat

I had created rules in my network to allow traffic to various hosts to/from 10.200.0.0/29

where?
what type of rules?
your openvpn server has iptables disabled...

However, it appears that the client is actually using an internal IP 10.100.0.0/22 on the inside of the network.

i assume your clients are located in internet OUTSIDE of your network right?

Michael.

jasondharper

It appears my issue is solved. I think the IP forwarding settings in sysctl didn't take place until I rebooted. Now everything is working fine and my outside clients appear to be coming from the 10.200.0.0/29 VPN subnet.

Thank you for your help!