topology like a net29?

mgrant

I am looking for a way to route a small subnet like a /29 across the vpn such that the openvpn client (acting as a router) could route the extra addresses to the lan on the other side.

In a net30 topology, the /30 looks like this:

10.0.0.4 not available
10.0.0.5 server
10.0.0.6 client
10.0.0.7 not available

What would I use to allocate an entire /29 to the client. For example, something like this:

10.0.0.8 not available
10.0.0.9 server
10.0.0.10 client
10.0.0.11 client
10.0.0.12 client
10.0.0.13 client
10.0.0.14 client
10.0.0.15 not available

I need to do NAT on the client to forward, for example, 10.0.0.11 address to a 192.168.1.2. Unfortunately I can't use port forwarding, it has to be an IP address. There are lots of clients and each client has a 192.168.1.x network on its local ethernet, I am trying to map these myriad of 192.168.1.x addresses into many different 10.x.y.z addresses so I an get at them individually easily from the server. I know it's an odd setup, I don't have much control over the 192.168.1.x networks.

Perhaps this is possible with topology p2p? None of the OpenVPN clients or server are Windows (they're all Linux).

Maybe I am not thinking about this correctly... Maybe I should be using topology subnet and have something add a route for example when the client connects and is given 10.0.0.2, something could add a route for 10.10.10.0/24 to 10.0.0.2. Then on the client side I could nat addresses as I need. How would I create these routes in this case? A client-connect script perhaps?

Traffic

See --client-nat and --ifconfig-push in The Manual v23x

mgrant

I need a bit more info to be able to do this. I've included a picture below of one possible way to solve my problem.

The goal is for the server to be able to access each of the clients on separate IP addresses. To be clear, it's the server initiating the connection to the clients, not the clients.

Luckily or unluckily, each network connecting in is identical. Let's say they all have 3 devices and the IP addresses are always the same, 192.168.1.10, .11, an .12. I can't change this.

My idea is to have the OpenVPN client perform NAT and map a 10.8.x.y address to each of the 192.168.1.y devices.

see this image here:
http://grant.org/mgrant/pub_images/nat-subnets.png

I can't easily, in advance, create a client-config-directory file for each client because I don't know them all in advance. They are logging in with certificates which are created on a different machine for security reasons.

What I imagine I can do is use a learn-address script to set up and push the routing/natting out to the OpenVPN client. I could use such a script to create a client-config-directory file so the next time the client connects they get the same subnet sort of like ipp.txt.

But in order to do this, I would need to push some commands out to the OpenVPN Client in the learn-address script. Is that possible and if so, how?

Is there some easier way to do this?

Traffic

mgrant wrotesee this image here:
http://grant.org/mgrant/pub_images/nat-subnets.png

What you are trying to do in this picture is not correct ..

Your OpenVPN client will provide routing for the client side hosts.
The client side hosts will not get a 10.8.x.x VPN address.

You need to read how OpenVPN handles client side LANs:
HOWTO: Expanding the scope of the VPN to include additional machines

mgrant wroteWhat I imagine I can do is use a learn-address script to set up and push the routing/natting out to the OpenVPN client

that is done with the --client-connect-dir config file.

mgrant

Thanks Traffic.

I have read that. That page assumes each of the connecting clients have a unique subnet behind them. (i.e. client1 has 192.168.1.0/24, client2 has 192.168.2.0/24...etc). This is not the case with me. They are all 192.168.1.0/24.

I have something partly working using NAT and port forwarding on the openvpn client. This would be sufficient if each of the 192.168.1.x clients presented a service on a unique port, this is not the case! I really do need to give each of them a separate IP address on the server side somehow. To make matters worse, there is no way for me to change the addressing used on the client side of the openvpn tunnel. I'm stuck with it.

I tried today to understand how dnat and snat work. I couldn't make anything work with an address different from the openvpn client. I tried a number of things which I am happy to post but it's long. I do not seem to be able to create an snat or dnat rule that actually modifies the address AND the ports. Essentially what I did was use route and iroute to send a 10.9.0.x address to the openvpn client (which is 10.8.0.2) and try to modify it with NAT to send it to the proper server like I was able to do above. I tried using the snat and dnat within openvpn and also tried with iptables directly. Nothing I did seemed to have any effect though I do have the 10.9.0.x network showing up in tun0 on the client, but I can't seem to modify it with NAT at all.

It would be really useful to be able to use tcpdump at different places in the routing to see what iptables is actually doing.

By the way, I don't need the clients to be able to talk to the clients. I just need the server to be able to connect to each of the clients.

Any other suggestions how I can accomplish what I need?