Hi, I have recently succesfully configured OpenVPN on VPS running Debian. I have a server in my local network and no public IP, so I decided to use VPN as my gateway. Generally everything works fine, so clients can connect with VPS on a specific port, then VPN running on that VPS forwards it to the VPN client (my home router) and then this router distributes it to the server. The problem is that on my server I can see the same IP on all connections, which is VPN server IP 10.8.0.1. My question is, how to configure the server and (I think) routing, to be able to see on the local server the real IP of connected client?

[url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url]

Thanks for pointing me to this manual. I was able to extend my network, but unfortunatelly it hasn't resolved my main problem. What I have additionally did, and what is not mentioned in this article, I have changed destination address in port forwarding rule from 10.8.0.101 (which is assigned by OpenVPN to that client) to 10.10.10.5 (which is physically the server in my LAN). Everything works as it was, but still I can see only 10.8.0.1 as the origin of each client connected to the server. It's probably more about iptables and/or MikroTik firewall (my edge router connected to VPN as client) than OpenVPN itself, but I am completly new to that, and don't know what to do now. I also changed typical masquerade rule: [code] iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE [/code] to: [code] iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j SNAT --to-source 1.1.1.1 [/code] where 1.1.1.1 i public IP ofmy VPS. I made the same changes to MikroTik rules (change masquerade to src-nat rule), but still no joy.

I`m not so sure the Server in LAN, who is behind a client (router), can "see" other clients IP`s. But Server in LAN could connect to OpenVPN-Server on VPS`s management interface...

[quote=Pippin post_id=75111 time=1513837848 user_id=32724] I`m not so sure the Server in LAN, who is behind a client (router), can "see" other clients IP`s. But Server in LAN could connect to OpenVPN-Server on VPS`s management interface... [/quote] And...? What do you mean?

See --management IP port in manual: https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Add for example [code]management 127.0.0.1 2000 [/code]to server config and restart. Connect by SSH: [code]ssh root@open.vpn.server.vps[/code] Then use netcat/telnet to connect to management interface: [code]nc 127.0.0.1 2000[/code] Type help and also read here https://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html

I did what you advised, and here what it is. I can't really find anything relating to my issue. Could you please be so kind and point me in more detail? [code] root@myvillage:~# nc 127.0.0.1 2000 >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info help Management Interface for OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 26 2017 Commands: auth-retry t : Auth failure retry mode (none,interact,nointeract). bytecount n : Show bytes in/out, update every n secs (0=off). echo [on|off] [N|all] : Like log, but only show messages in echo buffer. exit|quit : Close management session. forget-passwords : Forget passwords entered so far. help : Print this message. hold [on|off|release] : Set/show hold flag to on/off state, or release current hold and start tunnel. kill cn : Kill the client instance(s) having common name cn. kill IP:port : Kill the client instance connecting from IP:port. load-stats : Show global server load stats. log [on|off] [N|all] : Turn on/off realtime log display + show last N lines or 'all' for entire history. mute [n] : Set log mute level to n, or show level if n is absent. needok type action : Enter confirmation for NEED-OK request of 'type', where action = 'ok' or 'cancel'. needstr type action : Enter confirmation for NEED-STR request of 'type', where action is reply string. net : (Windows only) Show network info and routing table. password type p : Enter password p for a queried OpenVPN password. remote type [host port] : Override remote directive, type=ACCEPT|MOD|SKIP. proxy type [host port flags] : Enter dynamic proxy server info. pid : Show process ID of the current OpenVPN process. pkcs11-id-count : Get number of available PKCS#11 identities. pkcs11-id-get index : Get PKCS#11 identity at index. client-auth CID KID : Authenticate client-id/key-id CID/KID (MULTILINE) client-auth-nt CID KID : Authenticate client-id/key-id CID/KID client-deny CID KID R [CR] : Deny auth client-id/key-id CID/KID with log reason text R and optional client reason text CR client-kill CID [M] : Kill client instance CID with message M (def=RESTART) env-filter [level] : Set env-var filter level client-pf CID : Define packet filter for client CID (MULTILINE) rsa-sig : Enter an RSA signature in response to >RSA_SIGN challenge Enter signature base64 on subsequent lines followed by END signal s : Send signal s to daemon, s = SIGHUP|SIGTERM|SIGUSR1|SIGUSR2. state [on|off] [N|all] : Like log, but show state history. status [n] : Show current daemon status info using format #n. test n : Produce n lines of output for testing/debugging. username type u : Enter username u for a queried OpenVPN username. verb [n] : Set log verbosity level to n, or show if n is absent. version : Show current version number. END [/code]

When connected to management interface type status. You will see various info including client IP`s. [quote]CLIENT_LIST,admin,[u]cl.ie.nt.ip[/u]:20502,[u]192.168.168.2[/u],141939,259026,Thu Dec 21 11:12:02 2017,1513851122,admin[/quote]

Yes, I did that, but still don't understand, how it can help me. [code] status OpenVPN CLIENT LIST Updated,Thu Dec 21 10:21:03 2017 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since mikrotik,2.2.2.2:33996,8385646,9077747,Thu Dec 21 09:37:07 2017 fendoch,3.3.3.3:57032,1959946,1028985,Thu Dec 21 09:37:07 2017 ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref 10.8.0.201,fendoch,3.3.3.3:57032,Thu Dec 21 10:21:03 2017 10.10.10.0/24,mikrotik,2.2.2.2:33996,Thu Dec 21 09:37:09 2017 10.10.10.5C,mikrotik,2.2.2.2:33996,Thu Dec 21 10:21:03 2017 10.8.0.101,mikrotik,2.2.2.2:33996,Thu Dec 21 10:21:03 2017 192.168.88.0/24,fendoch,3.3.3.3:57032,Thu Dec 21 09:37:09 2017 GLOBAL STATS Max bcast/mcast queue length,10 END [/code] where: 2.2.2.2 - is my public IP 3.3.3.3 - is my friend's public IP

Source IP forwarding

matiaszon

And, nobody can help?

matiaszon

up up up
nothing?

TinCanTech

matiaszon wrote
TinCanTech wrote
matiaszon wrote My question is, how to configure the server and (I think) routing, to be able to see on the local server the real IP of connected client?
Do not use any form of masquerading ..
If I don't use masquerading, I can't use VPN server as a "gateway" for the client and all devices behind the client.

Yes you can .. you use routing correctly.

matiaszon

Would you be so kind and provide a correct way of routing?

TinCanTech

Teaching routing is beyond the scope of this forum.

You can setup a test lab and remove the masquerade from iptables then work out what routes you need.
However, reading from your thread I am not sure you will be able to get what you appear to be asking for
IE: Public address .. you will still only get a private LAN address.

If you really can't work it out then you can contact me privately: tincanteksup <at> gmail

« Previous Page