Source IP forwarding

matiaszon

Hi,

I have recently succesfully configured OpenVPN on VPS running Debian. I have a server in my local network and no public IP, so I decided to use VPN as my gateway. Generally everything works fine, so clients can connect with VPS on a specific port, then VPN running on that VPS forwards it to the VPN client (my home router) and then this router distributes it to the server. The problem is that on my server I can see the same IP on all connections, which is VPN server IP 10.8.0.1. My question is, how to configure the server and (I think) routing, to be able to see on the local server the real IP of connected client?

TinCanTech

HOWTO: Expanding the scope of the VPN to include additional machines

matiaszon

Thanks for pointing me to this manual. I was able to extend my network, but unfortunatelly it hasn't resolved my main problem. What I have additionally did, and what is not mentioned in this article, I have changed destination address in port forwarding rule from 10.8.0.101 (which is assigned by OpenVPN to that client) to 10.10.10.5 (which is physically the server in my LAN). Everything works as it was, but still I can see only 10.8.0.1 as the origin of each client connected to the server. It's probably more about iptables and/or MikroTik firewall (my edge router connected to VPN as client) than OpenVPN itself, but I am completly new to that, and don't know what to do now.

I also changed typical masquerade rule:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

to:

iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j SNAT --to-source 1.1.1.1

where 1.1.1.1 i public IP ofmy VPS.

I made the same changes to MikroTik rules (change masquerade to src-nat rule), but still no joy.

TinCanTech

matiaszon wrote My question is, how to configure the server and (I think) routing, to be able to see on the local server the real IP of connected client?

Do not use any form of masquerading ..

Pippin

I`m not so sure the Server in LAN, who is behind a client (router), can "see" other clients IP`s.

But Server in LAN could connect to OpenVPN-Server on VPS`s management interface...

matiaszon

TinCanTech wrote
matiaszon wrote My question is, how to configure the server and (I think) routing, to be able to see on the local server the real IP of connected client?
Do not use any form of masquerading ..

If I don't use masquerading, I can't use VPN server as a "gateway" for the client and all devices behind the client.

matiaszon

Pippin wrote I`m not so sure the Server in LAN, who is behind a client (router), can "see" other clients IP`s.

But Server in LAN could connect to OpenVPN-Server on VPS`s management interface...

And...? What do you mean?

Pippin

See --management IP port in manual:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

Add for example

management 127.0.0.1 2000

to server config and restart.
Connect by SSH:

ssh root@open.vpn.server.vps

Then use netcat/telnet to connect to management interface:

nc 127.0.0.1 2000

Type help and also read here
https://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html

matiaszon

I did what you advised, and here what it is.

I can't really find anything relating to my issue. Could you please be so kind and point me in more detail?

root@myvillage:~# nc 127.0.0.1 2000
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
help
Management Interface for OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 26 2017
Commands:
auth-retry t           : Auth failure retry mode (none,interact,nointeract).
bytecount n            : Show bytes in/out, update every n secs (0=off).
echo [on|off] [N|all]  : Like log, but only show messages in echo buffer.
exit|quit              : Close management session.
forget-passwords       : Forget passwords entered so far.
help                   : Print this message.
hold [on|off|release]  : Set/show hold flag to on/off state, or
                         release current hold and start tunnel.
kill cn                : Kill the client instance(s) having common name cn.
kill IP:port           : Kill the client instance connecting from IP:port.
load-stats             : Show global server load stats.
log [on|off] [N|all]   : Turn on/off realtime log display
                         + show last N lines or 'all' for entire history.
mute [n]               : Set log mute level to n, or show level if n is absent.
needok type action     : Enter confirmation for NEED-OK request of 'type',
                         where action = 'ok' or 'cancel'.
needstr type action    : Enter confirmation for NEED-STR request of 'type',
                         where action is reply string.
net                    : (Windows only) Show network info and routing table.
password type p        : Enter password p for a queried OpenVPN password.
remote type [host port] : Override remote directive, type=ACCEPT|MOD|SKIP.
proxy type [host port flags] : Enter dynamic proxy server info.
pid                    : Show process ID of the current OpenVPN process.
pkcs11-id-count        : Get number of available PKCS#11 identities.
pkcs11-id-get index    : Get PKCS#11 identity at index.
client-auth CID KID    : Authenticate client-id/key-id CID/KID (MULTILINE)
client-auth-nt CID KID : Authenticate client-id/key-id CID/KID
client-deny CID KID R [CR] : Deny auth client-id/key-id CID/KID with log reason
                             text R and optional client reason text CR
client-kill CID [M]    : Kill client instance CID with message M (def=RESTART)
env-filter [level]     : Set env-var filter level
client-pf CID          : Define packet filter for client CID (MULTILINE)
rsa-sig                : Enter an RSA signature in response to >RSA_SIGN challenge
                         Enter signature base64 on subsequent lines followed by END
signal s               : Send signal s to daemon,
                         s = SIGHUP|SIGTERM|SIGUSR1|SIGUSR2.
state [on|off] [N|all] : Like log, but show state history.
status [n]             : Show current daemon status info using format #n.
test n                 : Produce n lines of output for testing/debugging.
username type u        : Enter username u for a queried OpenVPN username.
verb [n]               : Set log verbosity level to n, or show if n is absent.
version                : Show current version number.
END

Pippin

When connected to management interface type status.
You will see various info including client IP`s.

CLIENT_LIST,admin,cl.ie.nt.ip:20502,192.168.168.2,141939,259026,Thu Dec 21 11:12:02 2017,1513851122,admin

matiaszon

Yes, I did that, but still don't understand, how it can help me.

status
OpenVPN CLIENT LIST
Updated,Thu Dec 21 10:21:03 2017
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
mikrotik,2.2.2.2:33996,8385646,9077747,Thu Dec 21 09:37:07 2017
fendoch,3.3.3.3:57032,1959946,1028985,Thu Dec 21 09:37:07 2017
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.201,fendoch,3.3.3.3:57032,Thu Dec 21 10:21:03 2017
10.10.10.0/24,mikrotik,2.2.2.2:33996,Thu Dec 21 09:37:09 2017
10.10.10.5C,mikrotik,2.2.2.2:33996,Thu Dec 21 10:21:03 2017
10.8.0.101,mikrotik,2.2.2.2:33996,Thu Dec 21 10:21:03 2017
192.168.88.0/24,fendoch,3.3.3.3:57032,Thu Dec 21 09:37:09 2017
GLOBAL STATS
Max bcast/mcast queue length,10
END

where:
2.2.2.2 - is my public IP
3.3.3.3 - is my friend's public IP

Pippin

Am I misunderstandig something?
You want to see client IP right?

to be able to see on the local server the real IP of connected client?

How it helps you, I can only guess.....

matiaszon

OK, I thought there is some misunderstanding. No, this is not what I wanted.

Once again...
1. I have a server working in MY LOCAL NET (10.10.10.0/24). Server IP is 10.10.10.5 and it works on port 2502.
2. I have a VPN running on VPS. My router (public IP: 2.2.2.2) is connected with VPN server (internal VPN server IP: 10.8.0.1) and received from the server internal IP: 10.8.0.101.
3. I have successfully enabled routing on OpenVPN to my subnet 10.10.10.0/24, so the server uses 10.8.0.101 as a gateway to my subnet.
4. I have successfully enabled port forwarding from VPS (1.1.1.1:2502) to my server (10.10.10.5:2502) and everything works.

Now, the problem is, that on my LOCAL SERVER (10.10.10.5) I can see connected clients, but all of them have the same source IP (10.8.0.1) while I can't see any of their real public IP. For example, if the client is connecting to my VPS 1.1.1.1:2502 (not to VPN! his connection is forwarded to my local server 10.10.10.5:2502) from IP 66.77.88.99 I see him connected as from 10.8.0.1 (as VPN server is a NAT for him I guess), also, if there is another user connected from 22.33.44.55, I also see him as connected from 10.8.0.1.

I hope this is clear now.

matiaszon

So,nobody knows the answer?

TinCanTech

matiaszon wrote I see him connected as from 10.8.0.1 (as VPN server is a NAT for him I guess), also, if there is another user connected from 22.33.44.55, I also see him as connected from 10.8.0.1

TinCanTech wrote Do not use any form of masquerading

Or NAT ..

If you want to see the real public IP like this 3.3.3.3:

matiaszon wrote Virtual Address,Common Name,Real Address,Last Ref
10.8.0.201,fendoch,3.3.3.3:57032,Thu Dec 21 10:21:03 2017

You can not because that is not the source of the connection .. you can only see the virtual address.

matiaszon

And what is the source, if a peer 33.44.55.66 starts the connection? It connects to my server (using no VPN) and then it is redirected to my router. I bet there is a solution. It is just a matter of setting up correctly. Maybe I should try to run PPPoE server on VPS and connect as client from my router so I would receive a public IP of that VPS? Theoretically it should be possible...

TinCanTech

matiaszon wrote And what is the source, if a peer 33.44.55.66 starts the connection? It connects to my server (using no VPN)

It no longer has anything to do with openvpn ..

Pippin

Ok, seems I understood it correctly.

Only the server knows the real IP. That why I suggested connecting to the management interface on the server.

Carefully look at the following diagram, it might show you why you cannot see the real IP of a connected client from another client (or subnet behind it):

Imagine a second client connecting, what does any other client see?

matiaszon

Still not this one case. I will make a diagram to explain it better. I need to see a real IP of a connection initiator, that is not a client of VPN. It connects to VPS, on which there is OpenVPN running. Then, it is forwarded to the VPN client.
As soon as I open my lap I will make a simple drawing.

matiaszon

OK, so here is the small diagram of the network, and description underneath.

1. Clients (4.4.4.4 and 5.5.5.5 and many more) are trying to connect to 1.1.1.1 on port 2502.
2. With iptables on VPS 1.1.1.1 I have redirected the traffic on port 2502 directly to 10.10.10.5 as OpenVPN can see whole network 10.10.10.0/24 nad 192.168.88.0/24 (but we will omit that in this case).
3. Server 10.10.10.5 gets something on port 2502 and replies to it to 4.4.4.4 or 5.5.5.5 (or any other) throught OpenVPN server.
This works.

The only thing, that I am not happy with is, that on server 10.10.10.5 I can see only 10.8.0.1 as a source IP. I would like to see 4.4.4.4or 5.5.5.5 - real IPs generally. None of these clients (4.4.4.4 or 5.5.5.5) are VPN clients. They are just forwarded through OpenVPN. As you can see, there is no VPN tunnel between 1.1.1.1 and 4.4.4.4 or between 1.1.1.1 and 5.5.5.5.