OpenVPN client as default gateway for OpenVPN server

BaN

Hello.

The OpenVPN server is running on a machine that's located behind the NAT and doesn't have access to the internet itself, but one of the tcp ports is forwarded to this machine from the internet, so I can connect to this OpenVPN server from internet.
What I want is to access the internet from the machine with OpenVPN server running.
Is it possible to add default gateway on OpenVPN server via OpenVPN client?
I thought I could add routes with script on client connection using client-connect option, but I ran into a problem with adding default gateway via OpenVPN client.
My configuration:

Server and client are running on Debian.

server.conf

port 1194
mode server
proto tcp-server
dev tun0
tls-server

dh /etc/openvpn/easy-rsa/keys/dh2048.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0

push "topology net30"
ifconfig 10.10.0.1 10.10.0.2
push "route 10.10.0.1"

route 10.10.0.0 255.255.255.0

push "route 10.10.0.0 255.255.255.0"

client-config-dir ccd

cipher BF-CBC
auth SHA1
daemon
script-security 2
client-connect client_connected.sh
client-disconnect client_disconnected.sh
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
user nobody
group nogroup
chroot /etc/openvpn/
mute 20
tun-mtu 1500
mssfix 1450
keepalive 10 60
comp-lzo
persist-key
persist-tun
hand-window 90
tls-timeout 10

ccd/client

ifconfig-push 10.10.0.5 10.10.0.6

client.conf

client
dev tun
tls-client
tls-timeout 30
proto tcp-client
hand-window 180
verb 3
mute 5
mtu-disc yes
cipher bf-cbc
auth sha1
comp-lzo
tun-mtu 1500
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
keepalive 10 120
reneg-sec 0
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client.crt
key /etc/openvpn/easy-rsa/keys/client.key
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 1
user nobody
group nogroup
chroot /etc/openvpn/
daemon
remote 1.1.1.1 1194

On server side I tried to configure routing like this, bypassing main table:

# ip rule
0:      from all lookup local
32000:  from all lookup vpn
32766:  from all lookup main
32767:  from all lookup default

And tried to add routes like this:

# ip route show table vpn
default dev tun0  scope link
10.10.0.5 dev tun0  scope link  src 10.10.0.1
192.168.0.0/24 dev eth0  scope link  src 192.168.0.2

where 192.168.0.0/24 - LAN on server side.
And on OpenVPN client side I enabled masquerade, all chains policies are ACCEPT:

# sysctl -w net.ipv4.ip_forward=1
# iptables -F
# iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE

Where eth0 is interface with internet.
With logging enabled:

iptables -t nat -I INPUT 1 -j LOG --log-prefix "NAT_INPUT:" --log-level 6
iptables -t nat -I OUTPUT 1 -j LOG --log-prefix "NAT_OUTPUT:" --log-level 6
iptables -t nat -I POSTROUTING 1 -j LOG --log-prefix "POSTROUTING:" --log-level 6
iptables -t nat -I PREROUTING 1 -j LOG --log-prefix "PREROUTING:" --log-level 6
iptables -I INPUT 1 -j LOG --log-prefix "INPUT:" --log-level 6
iptables -I FORWARD 1 -j LOG --log-prefix "FORWARD:" --log-level 6
iptables -I OUTPUT 1 -j LOG --log-prefix "OUTPUT:" --log-level 6

I test connection from server side with:

telnet 93.158.134.3 80

I can see on server side, that packets are sent:

Nov 20 17:22:23 openvpn_server kernel: [ 7618.968825] NAT_OUTPUT:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1008 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
Nov 20 17:22:23 openvpn_server kernel: [ 7618.968866] OUTPUT:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1008 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
Nov 20 17:22:23 openvpn_server kernel: [ 7618.968889] POSTROUTING:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1008 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
Nov 20 17:22:24 openvpn_server kernel: [ 7619.971401] OUTPUT:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1009 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
Nov 20 17:22:26 openvpn_server kernel: [ 7621.978214] OUTPUT:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1010 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
Nov 20 17:22:30 openvpn_server kernel: [ 7625.984028] OUTPUT:IN= OUT=tun0 SRC=10.10.0.1 DST=93.158.134.3 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=1011 DF PROTO=TCP SPT=48808 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0

But I don't see any packets on OpenVPN client side.
So there is something wrong with default gateway route on OpenVPN server:

default dev tun0  scope link

Does anyone know how can I make it work?
Maybe I should try to do it using TAP devices?

BaN

Fix:

# ip route show table vpn
default dev tun0  scope link
10.10.0.0/24 dev tun0  scope link
10.10.0.2 dev tun0  scope link  src 10.10.0.1
192.168.0.0/24 dev eth0  scope link  src 192.168.0.2

and:

# sysctl -w net.ipv4.ip_forward=1
# iptables -F
# iptables -t nat -F
# iptables -t mangle -F
# iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE

Traffic

BaN wroteThe OpenVPN server is running on a machine that's located behind the NAT and doesn't have access to the internet itself, but one of the tcp ports is forwarded to this machine from the internet, so I can connect to this OpenVPN server from internet.
What I want is to access the internet from the machine with OpenVPN server running.
Is it possible to add default gateway on OpenVPN server via OpenVPN client?

Yes .. but if you do you must route not NAT at the VPN server.

BaN

I can't understand, how does OpenVPN manage routes via tun interface.
Let's put aside the default gateway problem and try to route packets to the single host (for example 8.8.8.8) in the internet from server via client.
So how do a do it?
I tried to add this route on server side:

ip route add 8.8.8.8 via 10.149.0.1 dev tun0

But I don't see the packets coming on client side.

BaN

I found how to do it.
First I found out, that I need to specify iroute to the client in ccd file.
Then I tried with "iroute 0.0.0.0 0.0.0.0", but it didn't work, i googled about it and found a hack with adding:
iroute 1.0.0.0 255.0.0.0
...
iroute 255.0.0.0 255.0.0.0
to the client ccd and "route 1.0.0.0 255.0.0.0" ... to the server config.
This way I don't need to modify server default gateway.

Traffic

BaN wrotefound a hack with adding:
iroute 1.0.0.0 255.0.0.0
...
iroute 255.0.0.0 255.0.0.0
to the client ccd and "route 1.0.0.0 255.0.0.0" ... to the server config.

:roll: .. does the dot dot dot represent every number between 1 and 255 ?

Also, what about the route for the client public IP address ?