Can't get "redirect-gateway" to work correct

riahc3

On my client side, if I include "redirect-gateway", I can access the tunnel but I cannot access internet.
Without it, I can't access the tunnel but I can access internet.

server:

port 1194
proto udp
dev tun
ca keys/comp-ca/ca.crt
cert keys/comp-ca/comp-svr.crt
key keys/comp-ca/comp-svr.key
dh keys/comp-ca/dh2048.pem
server 10.10.10.1 255.255.255.0
crl-verify keys/comp-ca/crl.pem
ifconfig-pool-persist servers/compSVR/logs/ipp.txt
cipher AES-128-CBC
user root
group root
status servers/compSVR/logs/openvpn-status.log
log-append servers/compSVR/logs/openvpn.log
verb 2
mute 20
max-clients 200
management 127.0.0.1 7505
keepalive 10 120
client-config-dir /etc/openvpn/servers/compSVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 192.168.2.0 255.255.255.0"
push "route 192.168.100.0 255.255.255.0"

client:

client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert clientlocal.crt
key clientlocal.key
remote 192.168.100.200 1194
cipher AES-128-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

ccd:

ifconfig-push 10.10.10.177 10.10.10.178
iroute 192.168.100.100 255.255.255.0
iroute 172.16.0.0 255.255.0.0
push "route 192.168.100.0 255.255.255.0"
push "route 172.16.0.0 255.255.0.0"

I want to be able to do both.

maikcat

your remote directive in your client config points to private address,
how exactly are you testing your setup?

also,your server is linux based? if yes post the output of:

iptables -L -v
iptables -L -t nat -v

Michael.

riahc3

maikcat wroteyour remote directive in your client config points to private address,
how exactly are you testing your setup?

Yes, this is currently being tested internally. That would just be replaced with our WAN address

maikcat wrote also,your server is linux based? if yes post the output of:

iptables -L -v
iptables -L -t nat -v

Michael.

Yes.

iptables -L -v

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
 135K   29M ufw-before-logging-input  all  --  any    any     anywhere             anywhere
 135K   29M ufw-before-input  all  --  any    any     anywhere             anywhere
80572   12M ufw-after-input  all  --  any    any     anywhere             anywhere
 2307  179K ufw-after-logging-input  all  --  any    any     anywhere             anywhere
 2307  179K ufw-reject-input  all  --  any    any     anywhere             anywhere
 2307  179K ufw-track-input  all  --  any    any     anywhere             anywhere

Chain FORWARD (policy DROP 2737 packets, 180K bytes)
 pkts bytes target     prot opt in     out     source               destination 
 3171  217K ufw-before-logging-forward  all  --  any    any     anywhere             anywhere
 3171  217K ufw-before-forward  all  --  any    any     anywhere             anywhere
 2737  180K ufw-after-forward  all  --  any    any     anywhere             anywhere
 2737  180K ufw-after-logging-forward  all  --  any    any     anywhere             anywhere
 2737  180K ufw-reject-forward  all  --  any    any     anywhere             anywhere
 2737  180K ufw-track-forward  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 1 packets, 84 bytes)
 pkts bytes target     prot opt in     out     source               destination 
34915 5867K ufw-before-logging-output  all  --  any    any     anywhere             anywhere
34915 5867K ufw-before-output  all  --  any    any     anywhere             anywhere
   87  5806 ufw-after-output  all  --  any    any     anywhere             anywhere
   87  5806 ufw-after-logging-output  all  --  any    any     anywhere             anywhere
   87  5806 ufw-reject-output  all  --  any    any     anywhere             anywhere
   87  5806 ufw-track-output  all  --  any    any     anywhere             anywhere

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 
39653 3101K ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:netbios-ns
 2874  705K ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:netbios-dgm
    0     0 ufw-skip-to-policy-input  tcp  --  any    any     anywhere             anywhere             tcp dpt:netbios-ssn
    0     0 ufw-skip-to-policy-input  tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds
15940 5504K ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:bootps
    0     0 ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:bootpc
19798 2390K ufw-skip-to-policy-input  all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 
  803 59421 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 
  298 25160 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp parameter-problem
  136 11680 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
 2737  180K ufw-user-forward  all  --  any    any     anywhere             anywhere

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 
   72  8060 ACCEPT     all  --  lo     any     anywhere             anywhere    
39881   12M ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ufw-logging-deny  all  --  any    any     anywhere             anywhere             ctstate INVALID
    0     0 DROP       all  --  any    any     anywhere             anywhere             ctstate INVALID
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp parameter-problem
    2   120 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
14901 4888K ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:bootps dpt:bootpc
80596   12M ufw-not-local  all  --  any    any     anywhere             anywhere
   24  1779 ACCEPT     udp  --  any    any     anywhere             224.0.0.251          udp dpt:mdns
    0     0 ACCEPT     udp  --  any    any     anywhere             239.255.255.250      udp dpt:1900
80572   12M ufw-user-input  all  --  any    any     anywhere             anywhere

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 
   72  8060 ACCEPT     all  --  any    lo      anywhere             anywhere    
34756 5853K ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
   87  5806 ufw-user-output  all  --  any    any     anywhere             anywhere

Chain ufw-logging-allow (0 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 RETURN     all  --  any    any     anywhere             anywhere             ctstate INVALID limit: avg 3/min burst 10
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
 pkts bytes target     prot opt in     out     source               destination 
 2307  179K RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type LOCAL
   24  1779 RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type MULTICAST
78265   12M RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
    0     0 ufw-logging-deny  all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10
    0     0 DROP       all  --  any    any     anywhere             anywhere    

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-skip-to-policy-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 DROP       all  --  any    any     anywhere             anywhere    

Chain ufw-skip-to-policy-input (7 references)
 pkts bytes target     prot opt in     out     source               destination 
78265   12M ACCEPT     all  --  any    any     anywhere             anywhere    

Chain ufw-skip-to-policy-output (0 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere    

Chain ufw-track-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 
  101  5252 ACCEPT     tcp  --  any    any     anywhere             anywhere             ctstate NEW
 2206  173K ACCEPT     udp  --  any    any     anywhere             anywhere             ctstate NEW

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination 
   19  1140 ACCEPT     tcp  --  any    any     anywhere             anywhere             ctstate NEW
   67  4582 ACCEPT     udp  --  any    any     anywhere             anywhere             ctstate NEW

Chain ufw-user-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-user-limit (0 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere    

Chain ufw-user-logging-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-user-logging-input (0 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-user-logging-output (0 references)
 pkts bytes target     prot opt in     out     source               destination 

Chain ufw-user-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 22326 packets, 2882K bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain INPUT (policy ACCEPT 19218 packets, 2668K bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain OUTPUT (policy ACCEPT 110 packets, 7305 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain POSTROUTING (policy ACCEPT 110 packets, 7305 bytes)
 pkts bytes target     prot opt in     out     source               destination 
   24  1504 SNAT       all  --  any    eth0    10.10.10.0/24        anywhere             to:192.168.100.200

And just in case:

ifconfig:

eth0      Link encap:Ethernet  direcciónHW xx:xx:xx:xx:xx:xx
          Direc. inet:192.168.100.200  Difus.:192.168.100.255  Másc:255.255.255.0
          Dirección inet6: fe80::20c:29ff:febe:bbfc/64 Alcance:Enlace
          ACTIVO DIFUSIÓN FUNCIONANDO MULTICAST  MTU:1500  Métrica:1
          Paquetes RX:456985 errores:0 perdidos:15276 overruns:0 frame:0
          Paquetes TX:112492 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:1000
          Bytes RX:80970962 (80.9 MB)  TX bytes:25240221 (25.2 MB)

lo        Link encap:Bucle local
          Direc. inet:127.0.0.1  Másc:255.0.0.0
          Dirección inet6: ::1/128 Alcance:Anfitrión
          ACTIVO BUCLE FUNCIONANDO  MTU:65536  Métrica:1
          Paquetes RX:242 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:242 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:0
          Bytes RX:26355 (26.3 KB)  TX bytes:26355 (26.3 KB)

tun0      Link encap:UNSPEC  direcciónHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          Direc. inet:10.10.10.1  P-t-P:10.10.10.2  Másc:255.255.255.255
          ACTIVO PUNTO A PUNTO FUNCIONANDO NOARP MULTICAST  MTU:1500  Métrica:1
          Paquetes RX:11235 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:3732 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:100
          Bytes RX:920623 (920.6 KB)  TX bytes:484140 (484.1 KB)

My gateway is 192.168.100.100

maikcat

Yes, this is currently being tested internally. That would just be replaced with our WAN address

redirecting traffic while in the same lan is NOT a very good idea,
test your setup from an internet connection.

if you add a NAT rule (for accessing the internet via vpn) ALL traffic leaving your servers eth0 from vpn is NATed.

also you have posted a ccd file contents,what its filename?are you routing networks behind your client?

the importand is to test from a different network connection.

Michael.

riahc3

maikcat wrote
Yes, this is currently being tested internally. That would just be replaced with our WAN address
redirecting traffic while in the same lan is NOT a very good idea,
test your setup from an internet connection.

Already tested. Does the same thing.

maikcat wrote if you add a NAT rule (for accessing the internet via vpn) ALL traffic leaving your servers eth0 from vpn is NATed.

I do not want to access the internet via the VPN. I want to access it thru the LAN.

maikcat wrote also you have posted a ccd file contents,what its filename?are you routing networks behind your client?

The filename is the client's name.

Here is a diagram in case you are interested/helps:

I think I posted this diagram somewhere around here...That top PC on should have internet access thru the LAN.

maikcat

just saw the diagram....

why on earth the pc with ip 192.168.100.73 uses vpn to connect to vpn server 192.168.100.199????? :shock:

Michael.