Hello Evryone
I'm looking for some help because i can't reach my aim.
I'm administrating a server with some services inside LXC container.
This containers are in 10.0.0.0/24 ip range.
For exemple my web services are available at 10.0.0.W
My OpenVPN service is available at 10.0.0.V.
And on the LXC host there is an unbound server at 193.0.0.2.
I wish to connect to my openvpn, use my unbound DNS server and be able to connect to my website.
i configured openvpn, add some route instruction but i don't see clear in all this instruction
When i'm connecting to my openVPN server i can reach websites excepting mine. That's frustrating.
As my OpenVPN server and Web server are in different container i guess i should connect them with a route instruction. But do i need to add an instruction on container host ?
Here are my configuration :
On OpenVPN server
my server.conf
port 443
port-share 10.0.0.A XXXXXXX
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpn.crt
key /etc/openvpn/easy-rsa/keys/vpn.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh3072.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.0.0.254"
keepalive 10 120
cipher XXXXXXX
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 8
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf
client-cert-not-required
tls-version-min 1.2
reneg-sec 120
Here is openvpn LXC route:
default 10.0.0.254 0.0.0.0 UG 0 0 0 eth0
10.0.0.0 * 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
Here is the only iptables instruction on Openvpn LXC container :
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 10.0.0.V
On Web LXC container
Web LXC route
default 10.0.0.254 0.0.0.0 UG 0 0 0 eth0
10.0.0.0 * 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.0.0.V 255.255.255.0 UG 0 0 0 eth0
On my client
my client.conf
client
dev tun
proto tcp
remote avpn.somewhe.re 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
remote-cert-tls server
cipher XXXXXXXXXX
comp-lzo
verb 3
