edit routes on server or client ?

cheech

Hi,

since 1 week i have running my openvpn server with client and all fine instead of one point.

Environment

My Root Server: Deb 7 Openvpn Server OpenVPN 2.2.1 x86_64-linux-gnu
Running Services: Plesk, Postfix, Apache2, Bind9, Munin, Monit, TS3, Squid

Router: AVM Fritzbox 7390

Client: Win7 64bit OpenVPN 2.3.4 x86_64-w64-mingw32

Client config:

client
dev tun
proto udp
tls-client
redirect-gateway
remote 85.25.197.100 1194
ns-cert-type server
keepalive 60 600
persist-tun
persist-key
ca ca.crt
tls-auth ta.key 1
cert server01.crt
key server01.key
comp-lzo
verb 3
auth-user-pass
route-method exe
route-delay 2
pull
auth-user-pass login.conf
mssfix 1400
tun-mtu 1500
cipher AES-256-CBC
auth SHA512
tls-cipher DHE-RSA-AES256-SHA

Server config:

dev tun
proto udp
port 1194
ca keys/ca.crt
cert keys/server01.crt
key keys/server01.key
dh keys/dh2048.pem
tls-auth keys/ta.key 0
keepalive 60 600
comp-lzo
status openvpn-status.log
log openvpn.log
user nobody
group nogroup
persist-key
persist-tun
server 192.168.1.0 255.255.255.0
push "redirect-gateway 85.25.197.100 def1"
push "route 192.168.1.0 255.255.255.0 net_gateway"
tls-server
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name
verb 4
#auth-nocache
mssfix 1400
tun-mtu 1500
cipher AES-256-CBC
auth SHA512
tls-cipher DHE-RSA-AES256-SHA

Win Routes when connection has been established:

===========================================================================
Schnittstellenliste
 15...00 ff ab 2b c9 05 ......TAP-Windows Adapter V9
 10...50 e5 49 53 b2 3a ......Realtek PCIe GBE Family Controller
 16...08 00 27 00 20 e0 ......VirtualBox Host-Only Ethernet Adapter
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter
 12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 14...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #2
 17...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #3
===========================================================================

IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0      192.168.1.5      192.168.1.6     31
    85.25.197.100  255.255.255.255  192.168.178.254   192.168.178.10     11
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
      192.168.1.0    255.255.255.0  192.168.178.254   192.168.178.10     11
      192.168.1.1  255.255.255.255      192.168.1.5      192.168.1.6     31
      192.168.1.4  255.255.255.252   Auf Verbindung       192.168.1.6    286
      192.168.1.6  255.255.255.255   Auf Verbindung       192.168.1.6    286
      192.168.1.7  255.255.255.255   Auf Verbindung       192.168.1.6    286
     192.168.56.0    255.255.255.0   Auf Verbindung      192.168.56.1    276
     192.168.56.1  255.255.255.255   Auf Verbindung      192.168.56.1    276
   192.168.56.255  255.255.255.255   Auf Verbindung      192.168.56.1    276
    192.168.178.0    255.255.255.0   Auf Verbindung    192.168.178.10    266
   192.168.178.10  255.255.255.255   Auf Verbindung    192.168.178.10    266
  192.168.178.255  255.255.255.255   Auf Verbindung    192.168.178.10    266
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.56.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung       192.168.1.6    286
        224.0.0.0        240.0.0.0   Auf Verbindung    192.168.178.10    266
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.56.1    276
  255.255.255.255  255.255.255.255   Auf Verbindung       192.168.1.6    286
  255.255.255.255  255.255.255.255   Auf Verbindung    192.168.178.10    266
===========================================================================
Ständige Routen:
  Keine

IPv6-Routentabelle
===========================================================================
Aktive Routen:
 If Metrik Netzwerkziel             Gateway
  1    306 ::1/128                  Auf Verbindung
 16    276 fe80::/64                Auf Verbindung
 16    276 fe80::bdc4:ab11:2922:d384/128
                                    Auf Verbindung
  1    306 ff00::/8                 Auf Verbindung
 16    276 ff00::/8                 Auf Verbindung
===========================================================================
Ständige Routen:
  Keine

When i do tracert to a webpage i can see the traffic goes over my VPN.
When i do a tracert to my homepage which have the same Public IP as my VPN Server, the traffic goes my GW from my Router (192.168.178.254) and not 192.168.1.1
When i check my emails is the same issue the VPN will not be used.

My question is how i have to modify the openvpn server/client config or my win routes to make sure that the vpn will be always used.

On my AVM box i can only add a forwarding but no routes like a Cisco router so i need a solution for it.

At the moment i have a ssh tunnel running to secure my email connection and proxy access too, but i would be happy i could only work with the vpn only.

THX
Cya
Cheech

Traffic

First things first ..

cheech wroteserver 192.168.1.0 255.255.255.0

Never Ever use 192.168.0.0/24 or 192.168.1.0/24 as either your Server LAN or indeed your VPN subnet *** change it to 10.8.0.0/24 or any other RFC1918 compliant address.

Next:

cheech wrotepush "redirect-gateway 85.25.197.100 def1"

This is completely wrong: See --redirect-gateway in The Manual v23x

Finally:

As you are trying to use --redirect-gateway to send all data over the VPN you cannot use services hosted on your server on that public IP (unless you have access to policy based routing *which is beyond the scope of this forum).

Therefore:

cheech wroteWhen i do tracert to a webpage i can see the traffic goes over my VPN.
When i do a tracert to my homepage which have the same Public IP as my VPN Server, the traffic goes my GW from my Router (192.168.178.254) and not 192.168.1.1
When i check my emails is the same issue the VPN will not be used.

taking your email as an example: does your email server use the same public IP as your VPN server .. if so it is correct that email is routed over the public internet not the VPN.

You could get around that issue by binding your Email server to the TAP interface of your VPN server on 192,168.1.1 and then direct your email client to seek the email server on 192.168.1.1 ( *** Change 192.168.1.1 as directed above)

cheech

OK THX

why is it wrong ? push "redirect-gateway 85.25.197.100 def1" 1. it works 2. it is my end point.

And yes the email server and apache2 all is working on the same public ip.

I tested last night and i changed my proxy settings to my VPN Network and i changed my proxy settings on windows and now i can access the proxy without the ssh tunnel so i guess i can configure my email client too. And that will fix my issue.

THX
CYa
Cheech

Traffic

cheech wrotewhy is it wrong ? push "redirect-gateway 85.25.197.100 def1" 1. it works

Check your logs .. I assure you it is wrong ...

Traffic wroteNext:
cheech wrote:
push "redirect-gateway 85.25.197.100 def1"
This is completely wrong: See --redirect-gateway in The Manual v23x

cheech

i have no error on my logs all fine .. b ut any way all is fine now from my end. and all is working.

cya
cheech

Traffic

Mon Feb 09 11:33:18 2015 us=953125 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Mon Feb 09 11:33:18 2015 us=953125 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
...
Mon Feb 09 11:33:31 2015 us=578125 PUSH: Received control message: 'PUSH_REPLY, ... ,redirect-gateway 10.1.101.1 def1, ... '
Mon Feb 09 11:33:31 2015 us=578125 Options error: unknown --redirect-gateway flag: 10.1.101.1

I assure you .. your config is wrong :geek: