Desire:
I have three machines. One is a OpenVPN server (S1), the other two are OpenVPN clients (C1 and C2). I want that C2 uses C1 as gateway for all (Internet) traffic (and not S1).
Research:
I've been trying to figure this out for quite a few days now, but I can't seem to configure it properly. I found similar posts which didn't really help me:
My setup:
My three machines (S1, C1, C2) are all connected to the internet. S1 and C1 directly; C2 behind a home-style modem router network. So none of the three machines are in the same LAN.
S1:
Debian, OpenVPN Server
cert name: server (fictive)
eth0: 1.2.3.4 (fictive)
tun0: 10.8.0.1 255.255.255.0
C1:
Debian, OpenVPN Client
cert name: linclient (fictive)
eth0: 5.6.7.8 (fictive)
tun1: 10.8.0.200 255.255.255.0
C2:
Windows 7, OpenVPN Client
cert name: winclient (fictive)
LAN: 10.0.2.15 (home network with modem router)
TUN/TAP IF: 10.8.0.2 255.255.255.0
Visual representation:
Regular OpenVPN network:
Desired path of Internet traffic departing from C2:
My configuration:
S1: 10.8.0.1 (OpenVPN Server) configuration:
/etc/openvpn/server.conf:
mode server
tls-server
topology subnet
push "topology subnet"
dev tun0
local 1.2.3.4
port 1194
proto udp
client-to-client
max-clients 200
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
ifconfig 10.8.0.1 255.255.255.0
ifconfig-pool 10.8.0.2 10.8.0.199 255.255.255.0
client-config-dir /etc/openvpn/clients
keepalive 4 12
comp-lzo yes
push "comp-lzo yes"
user nobody
group nogroup
persist-key
persist-tun
status status.log
verb 3
mute 20
/etc/openvpn/clients/linclient:
ifconfig-push 10.8.0.200 255.255.255.0
/etc/openvpn/clients/winclient:
push "route-gateway 10.8.0.200"
push "redirect-gateway def1"
C1: 10.8.0.200 (OpenVPN Client) configuration:
/etc/openvpn/linclient.conf:
remote 1.2.3.4 1194
client
dev tun1
ca ca.crt
cert linclient.crt
key linclient.key
tls-auth ta.key 1
remote-cert-tls server
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status status.log
verb 3
mute 20
C2: 10.8.0.2 (OpenVPN Client) configuration:
C:\Program Files\OpenVPN\config\winclient\winclient.ovpn:
remote 1.2.3.4 1194
client
dev tun
ca ca.crt
cert winclient.crt
key winclient.key
tls-auth ta.key 1
remote-cert-tls server
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status status.log
verb 3
mute 20
Client-to-client: working
Client-to-client is working: from all three machines I can ping the other two each time.
Specific settings on C1 so it can be gateway:
More settings on 10.8.0.200:
Ip forward:
root@10.8.0.200:~# cat /proc/sys/net/ipv4/ip_forward
1
*filter iptables:
root@10.8.0.200:~# iptables -L -n -v
Chain INPUT (policy ACCEPT 1752 packets, 142K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1496 packets, 184K bytes)
pkts bytes target prot opt in out source destination
*nat iptables:
root@10.8.0.200:~# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 7 packets, 1603 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
Problem
I can't ping the internet (ex. 8.8.8.8) from C2.
On C2
C:\Windows\system32>ping 8.8.8.8
Pinging 8.8.8.8 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 8.8.8.8:
Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),
Control-C
^C
Meanwhile on S1, the OpenVPN Server (10.8.0.1):
root@10.8.0.1:/# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
16:49:55.077094 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3938, length 40
16:49:59.844689 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3939, length 40
16:50:04.896020 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3940, length 40
16:50:09.938695 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3941, length 40
And also meanwhile on C1, the OpenVPN Client, the 'gateway' (10.8.0.200):
root@10.8.0.200:~# tcpdump -i tun1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
A traceroute from C2 to three points (S1, C1 and Internet):
C:\Windows\system32>tracert 10.8.0.1
Tracing route to 10.8.0.1 over a maximum of 30 hops
1 119 ms 119 ms 120 ms 10.8.0.1
Trace complete.
C:\Windows\system32>tracert 10.8.0.200
Tracing route to 10.8.0.200 over a maximum of 30 hops
1 226 ms 226 ms 225 ms 10.8.0.200
Trace complete.
C:\Windows\system32>tracert 8.8.8.8
Tracing route to 8.8.8.8 over a maximum of 30 hops
1 119 ms 119 ms 119 ms 10.8.0.1
2 * * * Request timed out.
3 * * * Request timed out.
4 ^C
Route table on C2
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.2.2 10.0.2.15 266
0.0.0.0 128.0.0.0 10.8.0.200 10.8.0.2 20
10.0.2.0 255.255.255.0 On-link 10.0.2.15 266
10.0.2.15 255.255.255.255 On-link 10.0.2.15 266
10.0.2.255 255.255.255.255 On-link 10.0.2.15 266
10.8.0.0 255.255.255.0 On-link 10.8.0.2 276
10.8.0.2 255.255.255.255 On-link 10.8.0.2 276
10.8.0.255 255.255.255.255 On-link 10.8.0.2 276
1.2.3.4 255.255.255.255 10.0.2.2 10.0.2.15 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.200 10.8.0.2 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.2.15 266
224.0.0.0 240.0.0.0 On-link 10.8.0.2 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.2.15 266
255.255.255.255 255.255.255.255 On-link 10.8.0.2 276
===========================================================================
Question:
Obviously, the traffic from C2 is being sent to S1; and not "directly" to C1 as I might expect from the given route table above.
How can I succeed in really using C1 as gateway, and only for C2?
Thanks in advance for your insights.
