OpenVPN routing to LAN

lawson23

Followed this guide to setup my openvpn on a raspberry pi. It works but...
I can't access the network the PI is on. I would like to access the local LAN.

In the past I used bridging with a windows install of openvpn.

Just wondering if I can make the setup so that I can access the local LAN and RDP to my devices. This is my intention for using the vpn configuration.

vpn client IP's are 10.8.0.0/24
Local Network is
192.168.12.0/24

Traffic

HOWTO: Expanding the scope of the VPN to include additional machines

Please see the Forum rules (top of page)

lawson23

Ok I added push "route 192.168.12.0 255.255.255.0"
to the server.conf file.

But I don't fully understand the rest of the document as far as what would be required from here.

Server.conf

local 192.168.12.98 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp
port 8010

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/VPN.crt # SWAP XX WITH YOUR SERVER NAME
key /etc/openvpn/easy-rsa/keys/VPN.key # SWAP XX WITH YOUR SERVER NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # IF YOU CHANGED YOUR ENCRYPTION TO 2048, CHANGE THAT HERE

server 10.8.0.0 255.255.255.0

# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2

# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"

# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"

# your local subnet
push "route 192.168.12.98 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

# advertise the local LAN subnet to VPN clients as being accessible through the$
push "route 192.168.12.0 255.255.255.0"

# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.12.254" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER ADDRESS AND SHOULD NOT NEED TO BE CHANGED

# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Traffic

lawson23 wrote# your local subnet
push "route 192.168.12.98 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

Tell the people who wrote the guide at Pi that they have done it wrong.

Hint: 192.168.12.0

lawson23

I have made the change but still not able to access the local 192 subnet resources.

Do I need to rebuild the client configuration file after making this change? I can post the client file but my concern is that it also contains the certificate information in it also which I would like to keep private.

Traffic

lawson23 wroteDo I need to rebuild the client configuration file

Probably not ..

lawson23 wrotemy concern is that it also contains the certificate information

If you ever post a config file you can remove the cert/key data as that is private and of no use for debugging ..

lawson23 wrotestill not able to access the local 192 subnet

Have you setup iptables NAT ?

lawson23

I believe so following this:
nano /etc/firewall-openvpn-rules.sh

#!/bin/sh

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.12.98

# SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

Traffic

Typically the correct rule for your setup is:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

lawson23 wrotenano /etc/firewall-openvpn-rules.sh

Code:
#!/bin/sh
<..>

Are you sure that is loaded ?

Try:

$ sudo iptables -t nat -L

lawson23

root@raspberrypi:/home/pi# sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  10.8.0.0/24          anywhere             to:192.168.123.98

Traffic

Please post your client log at --verb 4 (remove private data)

lawson23

Ok on a windows PC I figured it out by not being able to generate a new log file. Was not running gui app as an administrator once I did this the routing worked out of the box as intended.

I now need to look at why I'm having issues on my android phone with RDP when using OpenVPN.

Thanks for all the help but I believe from an OpenVPN perspective we have solved the issue! Again thank you!