Hello,
I want to setup a server as follows:
the server is connected to a LAN 172.16.0.0/255.255.0.0 the gatway is 172.16.0.1.
At the server:
wlan0 connectet to 172.16.0.1 as 172.16.0.150
tun0 openvpn server, reachable from WAN
tun1 openvpn clienet connected to comercial vpn Amsterdam
tun2 openvpn clienet connected to comercial vpn New York
What shuold be:
client1 (road warrior) from WAN to tun0 should be routed to Amsterdam
client2 (road warrior) from WAN tun0 should be routed to New York
I'm trying hard for about 10 days, but confused with all the
route,
push route and
iroute options.
I have done all the "rtfm" stuff, but it can't get it to work :-(
configuration below not working, because no routes are defined.
The question is, how should the routing look like. (no need for client to client)
The settings for tun0:
dev tun0
proto udp
port 443
client-config-dir ccd
log /etc/openvpn/LOG_Server.txt
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
topology subnet
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "topology subnet"
comp-lzo
ccd client1:
ifconfig-push 10.8.1.20 10.8.1.2
ccd client2:
ifconfig-push 10.8.2.20 10.8.2.2
conf Amsterdam:
log /etc/openvpn/LOGxxxx
proto udp
tun-mtu 1500
fragment 1300
mssfix
cipher AES-256-CBC
remote xxxxxxx.amsterdam.zzz 149
remote xxxxxxx.amsterdam.zzz 1151
remote xxxxxxx.amsterdam.zzz 1150
remote xxxxxxx.amsterdam.zzz 1149
remote xxxxxxx.amsterdam.zzz 151
remote xxxxxxx.amsterdam.zzz 150
remote xxxxxxx.amsterdam.zzz 1149
remote xxxxxxx.amsterdam.zzz 1150
remote xxxxxxx.amsterdam.zzz 151
remote xxxxxxx.amsterdam.zzz 1150
remote xxxxxxx.amsterdam.zzz 1151
auth SHA512
auth-user-pass /etc/openvpn/servers/userpass.txt
client
comp-lzo
dev tun2
#float
hand-window 120
inactive 604800
mute-replay-warnings
#nobind
route-nopull
ns-cert-type server
persist-key
persist-remote-ip
persist-tun
ping 5
ping-restart 120
remote-random
reneg-sec 3600
resolv-retry 60
route-delay 2
route-method exe
script-security 2
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
tls-timeout 5
verb 4
ca /etc/openvpn/servers/ca.crt
cert /etc/openvpn/servers/21_cl.crt
key /etc/openvpn/servers/21_cl.key
tls-auth /etc/openvpn/servers/21_ta.key 1
conf New York, same as above, with remote xxx.newyork.zzz and path to keys and certs of newyork
ifconfig (wether tun1 is up or tun2 is up, depends on who is first?!):
lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING MTU:65536 Metrik:1
RX packets:136 errors:0 dropped:0 overruns:0 frame:0
TX packets:136 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:11472 (11.2 KiB) TX bytes:11472 (11.2 KiB)
tun0 Link encap:UNSPEC Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet Adresse:10.8.0.1 P-z-P:10.8.0.1 Maske:255.255.255.0
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun2 Link encap:UNSPEC Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet Adresse:10.16.21.20 P-z-P:10.16.21.20 Maske:255.255.255.0
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metrik:1
RX packets:14 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX bytes:840 (840.0 B) TX bytes:0 (0.0 B)
wlan0 Link encap:Ethernet Hardware Adresse 80:1f:02:ed:ff:6e
inet Adresse:172.16.0.150 Bcast:172.16.255.255 Maske:255.255.0.0
inet6-Adresse: 4xxx:2xx:ax:8x:8c1e:76xb:6xb:c43/64 Gültigkeitsbereich:Global
inet6-Adresse: 2x2:8x9:7x:3cex:9x4:36fe:4008:5448/64 Gültigkeitsbereich:Global
inet6-Adresse: fx0::ecx:1f5a:1xb:bxf/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:2538 errors:0 dropped:77 overruns:0 frame:0
TX packets:1829 errors:0 dropped:1 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:514019 (501.9 KiB) TX bytes:336773 (328.8 KiB)
and to make it complete:
redirect enabled on all server/client
and the iptables script on server is:
#! /bin/sh
### BEGIN INIT INFO
# Provides: rpivpn
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: VPN initialisation script
### END INIT INFO
sysctl -w net.ipv4.ip_forward=1
iptables -F -t nat
iptables -F
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
output of "route"
Ziel Router Genmask Flags Metric Ref Use Iface
default fritz.box 0.0.0.0 UG 0 0 0 wlan0
default fritz.box 0.0.0.0 UG 303 0 0 wlan0
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
10.16.21.0 * 255.255.255.0 U 0 0 0 tun2
172.16.0.0 * 255.255.0.0 U 0 0 0 wlan0
172.16.0.0 * 255.255.0.0 U 303 0 0 wlan0
error log of Amsterdam:
...
TCP/UDP: Socket bind failed on local address [undef]: Address already in use
...
Whould be verry happy for some help
ostfriese
