Hello, I am having a difficult time configuring my system to only allow incoming connections over VPN. Apologies if this same situation has been asked about before. I went looking through the threads and did not find a match to what I am trying to achieve.
My ISP blocks ports for all incoming traffic to my home. In most cases I am OK with this for the sake of security. However, I have one computer on my network that I would like to access when away from home. I have successfully been able to connect as a client with a VPN service that I am using, and I am able to connect to the computer over the connection, which is great!
The problem is, I really only want external incoming connections to be handled over the VPN. I want all outgoing connections and incoming connections from my LAN to not be over the VPN. Is this possible to achieve? I have spent about a week now trying different steps I found online, and got to the point where I can have a connection where all traffic is over VPN, or a connection where no traffic is over the VPN (but the VPN is supposedly connected).
Can I achieve my goal with routing tables, iptables, or something else?
Info on the machine:
- Running Debian 8 on Linux kernel 3.16.0-4-amd64, headless (command line only access).
- This machine will serve as the router & gateway on my home network.
- The LAN will be via a bridge connecting the interfaces of a 4 port nic together.
My client configuration file:
client
dev tun0
proto tcp
remote My_VPNs_Address
persist-key
persist-tun
ca ca.crt
tls-auth Wdc.key 1
cipher AES-256-CBC
comp-lzo
verb 1
mute 20
route-method exe
route-delay 2
route 0.0.0.0 0.0.0.0
float
auth-user-pass pass
auth-retry interact
ifconfig-nowarn
I have tried adding the following to the config file:
route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway
[And remove route 0.0.0.0 0.0.0.0]
I had read this prevents the VPN server from assigning any routes. And it looks like it works too effectively (as I don’t know what to add back in to let incoming traffic through).
The redirect_gateway flag seems to be useful if I want all traffic over VPN only.
I have tried following the guide at
http://dltj.org/article/openvpn-split-routing/ but I confess I am amateur hobbyist when it comes to networking, and I do not know how to go about properly setting up virtual nets, or if I even really need that approach for my situation.
Also: is it possible to manage the VPN tunnel through network interfaces while at the same time having it start up during boot via /etc/default/openvpn.
Any feedback would be appreciated. If you know of some guides that can help me out or have a solution in mind I will be eager to hear about it.
Regards,
nfbartelt
