Hi,
I'm trying to set up my FreeBSD OpenVPN server to be split-tunnel so that I can use it to give my staff access to our management network without hijacking their default routes. The OpenVPN server is dual-homed (dual NICs) on our public IP space as well as our management network (172.20.5.0/24), and has its own routes for access to other management subnets (172.20.1.0/24, 172.20.2.0/24, 172.20.3.0/24 and 172.20.4.0/24). The host itself is able to ping both public IPs and management network IPs on all subnets. I've also set "gateway_enabled=yes" in my /etc/rc.conf.
Users are able to authenticate to the OpenVPN server, and they get an OpenVPN IP address, but are not able to access anything else, even the OpenVPN server itself.
Here's what I've got in my openvpn.conf so far:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.9.8.0 255.255.255.0
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
client-cert-not-required
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
status /var/log/openvpn.log
verb 4
client-to-client
push "route 172.20.1.0 255.255.255.0 10.9.8.5"
push "route 172.20.2.0 255.255.255.0 10.9.8.5"
push "route 172.20.3.0 255.255.255.0 10.9.8.5"
push "route 172.20.4.0 255.255.255.0 10.9.8.5"
push "route 172.20.5.0 255.255.255.0 10.9.8.5"
So, there's a few things I'm struggling with:
- How do I get the server to NOT offer a default route? Currently, my client always assumes that the OpenVPN server should be the default router, which is not what I want.
- What's the correct destination IP for the "push route" commands? 10.9.8.5 is what the OpenVPN server calls itself, but the actual router is 172.20.5.1 for all those routes. The OpenVPN server changes its local IP periodically when it's re-started, so obviously 10.9.8.5 is incorrect.
- Is it confusing/problematic to use 10.9.8.0/24 for client IPs? Should I use 172.20.6.0/24 instead?
