Using VPN to connect to home LAN

gaah666

Hello!

My goal: I want to use VPN to connect to my home network. Only traffic to the LAN should go there from connected VPN client, general surfing for instance should not.

I have a LAN at home using 10.200.11.0/24, where I have the router at 1, nas at 2 and server (which includes openvpn and plex server) at 3. The VPN is setup to distribute IP's at 10.200.12.0/24.
While connected with VPN using my current setup I can (from work using 192.168.0.0 -range) connect to the server using the ip 10.200.11.3 (both SSH and plex work), but I can't connect to anything else (router, nas aso).

I don't use any software firewall since the router acts as a hardware one (off topic but: is this a bad idea when I trust the internal traffic on the LAN?).

OS: Arch Linux (fully upgraded as of yesterday)
Client: Tunnelblick on OSX (latest version as of today)
Router: D-Link DIR-850L

Router settings:
Port forward: all UDP traffic to port 1194 to my server, 10.200.11.3
Static route: 10.200.12.0/24 to 10.200.11.3 using metric=1 and wan settings (whatever those mean, I have no idea)
(Both SSH and Plex on the server are available on LAN only and not exposed in the router settings.)

My server config file:

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.crt
key /etc/openvpn/secret.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.200.12.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.200.11.0 255.255.255.0"
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

(I disabled compression since that didn't work with my IOS client.)

Hope you can help a lost soul out! :-)

Traffic

Help us help you ...

Please see the Forum rules (top of page)

FYI:
HOWTO: Expanding the scope of the VPN to include additional machines
(Requires NAT@server or route@default-gateway)

gaah666

I did read the forum rules and I think that I clearly stated my goal and my config on server side. On client side I use Tunnelblick -> not sure how I can post that config...
I don't have trouble connecting to the VPN, I do have trouble finding other entities on the LAN. I didn't think the logs would say anything about that but here they are...

I have no idea what TUN/TAP forwarding even means or how to do it. The link in the guide doesn't say... However, IP forwarding is on from what I can tell?

sysctl -a | grep forward

Gives me:

net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.enp0s25.forwarding = 1
net.ipv4.conf.enp0s25.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.wlp2s0.forwarding = 1
net.ipv4.conf.wlp2s0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
sysctl: reading key "net.ipv6.conf.all.stable_secret"
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.default.stable_secret"
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.enp0s25.stable_secret"
net.ipv6.conf.enp0s25.forwarding = 0
net.ipv6.conf.enp0s25.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.tun0.stable_secret"
net.ipv6.conf.tun0.forwarding = 0
net.ipv6.conf.tun0.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.wlp2s0.stable_secret"
net.ipv6.conf.wlp2s0.forwarding = 0
net.ipv6.conf.wlp2s0.mc_forwarding = 0

Server (with verb 4):

OpenVPN CLIENT LIST
Updated,Sun Dec  6 16:49:47 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
gaah,[PUBLIC IP]:31992,32945,27217,Sun Dec  6 16:44:32 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.200.12.6,gaah,[PUBLIC IP]:31992,Sun Dec  6 16:49:41 2015
GLOBAL STATS
Max bcast/mcast queue length,0
END

Client (Tunnelblic, no option to set logging level that I can find but this is what I got):

2015-12-06 16:43:12 *Tunnelblick: OS X 10.11.1; Tunnelblick 3.5.5 (build 4270.4461); prior version 3.5.4 (build 4270.4395)
2015-12-06 16:43:13 *Tunnelblick: Attempting connection with gaah using shadow copy; Set nameserver = 1; monitoring connection
2015-12-06 16:43:13 *Tunnelblick: openvpnstart start gaah.tblk 1337 1 0 1 0 16688 -ptADGNWradsgnw 2.3.6
2015-12-06 16:43:14 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sgaah-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sgaah.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/gaah/gaah.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Users/gaah/gaah.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Users/gaah/gaah.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw

2015-12-06 16:43:13 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Dec  4 2015
2015-12-06 16:43:13 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.08
2015-12-06 16:43:13 *Tunnelblick: openvpnstart starting OpenVPN
2015-12-06 16:43:14 *Tunnelblick: Established communication with OpenVPN
2015-12-06 16:43:14 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-12-06 16:43:14 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-12-06 16:43:14 Control Channel Authentication: tls-auth using INLINE static key file
2015-12-06 16:43:15 UDPv4 link local: [undef]
2015-12-06 16:43:15 UDPv4 link remote: [AF_INET]217.209.76.62:1194
2015-12-06 16:43:15 [minichaos] Peer Connection Initiated with [AF_INET]217.209.76.62:1194
2015-12-06 16:43:18 Opening utun (connect(AF_SYS_CONTROL)): Resource busy
2015-12-06 16:43:18 Opening utun (connect(AF_SYS_CONTROL)): Resource busy
2015-12-06 16:43:18 Opened utun device utun2
2015-12-06 16:43:18 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2015-12-06 16:43:18 /sbin/ifconfig utun2 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2015-12-06 16:43:18 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2015-12-06 16:43:18 /sbin/ifconfig utun2 10.200.12.6 10.200.12.5 mtu 1500 netmask 255.255.255.255 up
2015-12-06 16:43:18 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw utun2 1500 1541 10.200.12.6 10.200.12.5 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        No network configuration changes need to be made.
                                        Will NOT monitor for other network configuration changes.
                                        DNS servers '172.20.10.1' will be used for DNS queries when the VPN is active
                                        The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                                        Flushed the DNS cache via dscacheutil
                                        /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
                                        add net 10.200.11.0: gateway 10.200.12.5
                                        add net 10.200.12.1: gateway 10.200.12.5
2015-12-06 16:43:20 *Tunnelblick: No 'connected.sh' script to execute
2015-12-06 16:43:20 Initialization Sequence Completed

Any other info I can give you that might help help me figuring this out?

Traffic

Can you ping the LAN ip address of the server over the VPN from the client ?
eg: 10.200.11.3

gaah666

Yes I can ping 10.200.11.3, but nothing else on that network.

Traffic

gaah666 wroteOS: Arch Linux (fully upgraded as of yesterday)
Client: Tunnelblick on OSX (latest version as of today)
Router: D-Link DIR-850L

gaah666 wroteMy goal: I want to use VPN to connect to my home network

Traffic wroteFYI:
HOWTO: Expanding the scope of the VPN to include additional machines
(Requires NAT@server or route@default-gateway)

http://openvpn.net/index.php/open-source/documentation/howto.html#scope

I recommend you use NAT on this:

OS: Arch Linux (fully upgraded as of yesterday)

iptables -t nat -A POSTROUTING -s 10.200.12.0/24 -o eth0 -j MASQUERADE

which I presume is your VPN server ..

gaah666

Traffic wrote (Requires NAT@server or route@default-gateway)

gaah666 wrote Router settings:
Port forward: all UDP traffic to port 1194 to my server, 10.200.11.3
Static route: 10.200.12.0/24 to 10.200.11.3 using metric=1 and wan settings

Traffic wrote which I presume is your VPN server ..

gaah666 wrote I have a LAN at home using 10.200.11.0/24, where I have the router at 1, nas at 2 and server (which includes openvpn and plex server) at 3. The VPN is setup to distribute IP's at 10.200.12.0/24.

VPN Server ip in it's own subnet is 10.200.12.1 since, according to the configuration file, it always gives the first address to itself.

Traffic wrotehttp://openvpn.net/index.php/open-source/documentation/howto.html#scope

gaah666 wroteI have no idea what TUN/TAP forwarding even means or how to do it. The link in the guide doesn't say... However, IP forwarding is on from what I can tell?

sysctl -a | grep forward

Gives me:

net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.enp0s25.forwarding = 1
net.ipv4.conf.enp0s25.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.wlp2s0.forwarding = 1
net.ipv4.conf.wlp2s0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
sysctl: reading key "net.ipv6.conf.all.stable_secret"
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.default.stable_secret"
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.enp0s25.stable_secret"
net.ipv6.conf.enp0s25.forwarding = 0
net.ipv6.conf.enp0s25.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.tun0.stable_secret"
net.ipv6.conf.tun0.forwarding = 0
net.ipv6.conf.tun0.mc_forwarding = 0
sysctl: reading key "net.ipv6.conf.wlp2s0.stable_secret"
net.ipv6.conf.wlp2s0.forwarding = 0
net.ipv6.conf.wlp2s0.mc_forwarding = 0

Traffic wroteI recommend you use NAT on this

Tried it, no change...
And also, why would this be better? Not second guessing you, I just want to understand...

While connected to the VPN server I can ping 10.200.12.1 (VPN server in it's own subnet), I can ping 10.200.11.3 (VPN server in "real" subnet).
I can't ping 10.200.11.1 (router) or 10.200.11.2 (nas).

My kernel does have the TUN module according to:

cat /proc/modules |grep tun

Traffic

Try deleting all your iptables rules and adding only this:

iptables -t nat -A POSTROUTING -s 10.200.12.0/24 -o enp0s25 -j MASQUERADE

where enp0s25 is the name of your ethernet device.

Also, disable your wireless wlp2s0 completely until this works.

gaah666

That did it!

For others in the same situation (commands run as root):

VPN configs are still the same
I removed the static route config from the router

Added the iptables rule as posted by Traffic:

iptables -t nat -A POSTROUTING -s 10.200.12.0/24 -o enp0s25 -j MASQUERADE

Saved the iptables rules to have them available after next reboot (after verifying that the file didn't exist already):

iptables-save > /etc/iptables/iptables.rules

Enable the service that restores the rules:

systemctl enable iptables

Reboot

Verify that rule is active:

iptables -t nat -L

Verify that pinging VPN Server in it's own subnet works (my 10.200.12.1)
Verify that pinging VPN Server in "real" subnet works (my 10.200.11.3)
Verify that pinging router works (my 10.200.11.1)
Verify that pinging something else on LAN works (my nas at 10.200.11.2)
All good!

It did work without disabling the wireless (but I'll describe how to disable it anyway if someone else could be helped by it). This is for Arch Linux:

Find which kernel module to disable:

lspci -vnn

Disable the module (and all others that depend on it if any), for me it was:

rmmod iwlmvm iwlwifi

The device is now gone from the list:

ip addr show

It will, however, be back after next reboot.

Traffic, thanks allot for all your help! Just out of curiosity, shouldn't the static route way work too? I understand that I don't need that now (since I don't need to make connections to devices in the VPN subnet), but what could have been the issue there?