Hi all, so basically what I want to achieve is connect different locations to central office, and provide internet access through OpenVPN server to clients only for specific resources. OpenVPN server is a Ubuntu 14.0.4 Server LTS HyperV machine. My config so far: [oconf=Server]mode server tls-server local 192.168.x.50 port 1194 proto udp dev tap0 persist-key persist-tun ca ca.crt cert server.crt key server.key dh dh2048.pem tls-auth ta.key 0 cipher BF-CBC comp-lzo client-to-client #push "redirect-gateway def1 bypass-dhcp" #push "dhcp-option DNS dns.server.ip" push "dhcp-option DOMAIN mydomain.com" user nobody group nogroup keepalive 10 120 status openvpn-status.log verb 3[/oconf] [oconf=Client]client dev tap remote wan.ip 1194 nobind resolv-retry infinite persist-key persist-tun ca ca.crt cert client.crt key client.key # note: 0 = server, 1 = client tls-auth ta.key 1 cipher BF-CBC comp-lzo verb 3[/oconf] As it is now I'm able to connect all clients just fine and access all internal resources but can't connect clients to internet through this VPN server, as only by adding [b]push "redirect-gateway def1 bypass-dhcp"[/b] I lose all inernal network access, clients still can connect to VPN server and get ip but can't ping even server's ip. So for start I would like at least all traffic from clients to go through VPN, then to figure out how to route only specific traffic through VPN and the rest through Client's physical connection.

I would really appreciate some help here guys, as I'm out of ideas atm, i actually observed that if i enable the [b]push "redirect-gateway def1 bypass-dhcp"[/b] line , i can actually ping clients from internal network, but i got a lot of [b]"destination host unreachable"[/b] messages also, and the response time is really dancing around erratically, ranging from a couple ms to thousands of ms. If there is anyone who got a bridged setup to redirect all client traffic to vpn server, please help.

You are not using openvpn --[b]server-bridge[/b] .. have you setup a bridge on your network card ?

[quote="TinCanTech"]You are not using openvpn --[b]server-bridge[/b] .. have you setup a bridge on your network card ?[/quote] Actually now I'm using the [b]"server-bridge "[/b] directive but it works and with local DHCP server, and yes my NIC is bridged.

[quote="TinCanTech"]So does it work now ?[/quote] No..because no changes were made, my setup already had included the directive you suggested, it's just I didn't included it in the Server config because it's not essential here, as I have and a DHCP server that can assign ip-s to remote VPN clients.

[quote="VSparxx"]I didn't included it in the Server config because it's [b]not essential[/b] here[/quote]How would you know what is essential ?

Because official openvpn documentation says so, one could configure the server itself to act as a dhcp server and push a range of ip-s to clients or you can configure the local dhcp server to push ip-s to clients. So in the example I posted in first post, clients would get ip-s from the local DHCP server, that's why the directive isn't there, and for what matters it doesn't make any difference if I specify [b]"server-bridge"[/b] directive or not, because when I add the push [b]"redirect-gateway def1 bypass-dhcp"[/b] to redirect all clients traffic through vpn server, it basically kills all client communication with server, as if i ping any active node i will get like a lot of [b]"destination hot unreachable"[/b] and here and there some actual reply from the node itself.

[quote="VSparxx"]So in the example I posted in first post, clients would get ip-s from the local DHCP server, that's why the directive isn't there, [b]and for what matters it doesn't make any difference if I specify "server-bridge" directive or not[/b],[/quote]So it was [u]not[/u] worth the developers writing the code for it then ...

I really don't know why do you want to argue about this, because I kinda have another problem, and that's what i hope to get help from people here for.

http://catb.org/~esr/faqs/smart-questions.html

Redirect specific client traffic over Bridged OpenVPN server

VSparxx

### Client configuration file for OpenVPN

# Specify that this is a client
client

# Bridge device setting
dev tap

# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote x.x.x.x 1100

# Client does not need to bind to a specific local port
nobind

# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite

# Preserve state across restarts
persist-key
persist-tun

# SSL/TLS parameters - files created previously
ca ca.crt
cert victor.crt
key victor.key

# Since we specified the tls-auth for server, we need it for the client
# note: 0 = server, 1 = client
tls-auth ta.key 1

# Specify same cipher as server
#cipher BF-CBC

# Use compression
comp-lzo

# Log verbosity (to help if there are problems)
verb 4

TinCanTech

Now please post result for $ brctl show

VSparxx

brctl show

bridge name	bridge id				STP enabled		interfaces
br0  			8000.00155d020b06		no				eth0
																	tap0

TinCanTech

Now please post result for server $ ifconfig

VSparxx

TinCanTech wroteNow please post result for server $ ifconfig

Sorry for taking your time, I have been finally able to test all this on another Win10 laptop and it all seems to work great, just not on my laptop, there seems to be some NIC driver issues maybe, as I don't see another explanation ( providing it's newly installed OS in a clean state ).

So now that I know for sure that all is working, I have the main question, how do I route only internal network and a specific website through VPN, all other traffic must go through client NIC ?
I've been looking through forum for days, also in manuals available at openvpn.net , HOW TO's and all that and I've been unable to find an answer.

TinCanTech

VSparxx wroteSorry for taking your time,

No problem .. I would not answer if I did not want or was not able to help.

VSparxx wroteI have been finally able to test all this on another Win10 laptop and it all seems to work great, just not on my laptop

Set your client configs with --verb 4 and then inspect the logs cearfully (post them if you wish) .. openvpn is quite good at detecting problems.

VSparxx

TinCanTech wroteSet your client configs with --verb 4 and then inspect the logs cearfully (post them if you wish) .. openvpn is quite good at detecting problems.

I already posted the problematic client log with "verb 4" set, it's a few posts above.

TinCanTech

Are you in London ? .. if so, I am too maybe we could work something else out ..

VSparxx wroteI have the main question, how do I route only internal network and a specific website through VPN, all other traffic must go through client NIC ?

Using a bridged style VPN, route only internal network is automatic, you are on the server LAN by default.

To route a specific website through VPN add the route to the client by the client config or push from the server.

# From the server
push "route ip.add.of.website 255.255.255.255 ip.of.gateway"

ip.of.gateway may be automatic but I am not totally sure.
To do this by website name, include --allow-pull-fqdn in the server config. (Be aware, this may not work as expected depending on who the website belongs to and your DNS solution)

For all other traffic must go through client NIC .. disable --redirect-gateway

There is one last thing to note:
With a bridged VPN, it may work better if the --server-bridge directive uses the server default gatway and not its own IP address eg:

server-bridge ipadd.of.default.gateway netmask pool-start-IP pool-end-IP

as per the manual .. (which appears to have changed recently).

Regards

VSparxx

Thank you very much for all your help and time, i'll try these later and i'll let you know how it went, as at the moment it's more of a priority for me to have this server working.

VSparxx

TinCanTech wroteAre you in London ? .. if so, I am too maybe we could work something else out ..

VSparxx wroteI have the main question, how do I route only internal network and a specific website through VPN, all other traffic must go through client NIC ?
Using a bridged style VPN, route only internal network is automatic, you are on the server LAN by default.

To route a specific website through VPN add the route to the client by the client config or push from the server.
# From the server
push "route ip.add.of.website 255.255.255.255 ip.of.gateway"
ip.of.gateway may be automatic but I am not totally sure.
To do this by website name, include --allow-pull-fqdn in the server config. (Be aware, this may not work as expected depending on who the website belongs to and your DNS solution)

For all other traffic must go through client NIC .. disable --redirect-gateway

There is one last thing to note:
With a bridged VPN, it may work better if the --server-bridge directive uses the server default gatway and not its own IP address eg:
server-bridge ipadd.of.default.gateway netmask pool-start-IP pool-end-IP
as per the manual .. (which appears to have changed recently).

Regards

OK, so I configured the server for my needs and it all seem to work like a charm, thank you very much for your help and patience.

Regarding the laptop that looses connectivity once the "redirect" directive is used, I don't think we should lose more time in trying to fix it as it's most definitely a driver issue.

TinCanTech

If you post details of the driver(s) and any related information perhaps the TAP driver developers would be interested ..

VSparxx

TinCanTech wroteIf you post details of the driver(s) and any related information perhaps the TAP driver developers would be interested ..

I'll surely post all information needed, just later, as atm this isn't my priority as it's a test laptop, not a machine used on daily basis.

VSparxx

Sorry TAP driver guys, I was really wanting to troubleshoot the problem with you but that laptop is already in use, as we really needed one for a new employee.
If at some point i'll have it on hands again we can start the troubleshoot then.

Cheers.

« Previous Page