I want to be able to access some servers that are in a private docker network that is not publicly accessable. But i do not want all internet traffic from the vpn clients to be tunneled through the vpn server.
I have set up a ovpn server using a docker container (kylemanna/openvpn) on a linux host.
I use a windows client to connect.
Lines in my server config
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log
user nobody
group nogroup
comp-lzo no
### Route Configurations Below
route 192.168.254.0 255.255.255.0
### Push Configurations Below
push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"
This are some parts from my client config:
client
nobind
dev tun
remote-cert-tls server
remote vpnserver.example.com 1194 udp
<key></key>
<cert></cert>
<ca></ca>
key-direction 1
<tls-auth></tls-auth>
redirect-gateway def1
route 172.17.0.0 255.255.255.0
The last route line i added myself and lets me me connect to the servers in that subnet.
Mon Sep 30 12:03:08 2019 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 25 2019
Mon Sep 30 12:03:08 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Sep 30 12:03:08 2019 library versions: OpenSSL 1.1.0j 20 Nov 2018, LZO 2.10
Enter Management Password:
Mon Sep 30 12:03:08 2019 TCP/UDP: Preserving recently used remote address: [AF_INET6]2a01:4f9xxxxx:1194
Mon Sep 30 12:03:08 2019 UDP link local: (not bound)
Mon Sep 30 12:03:08 2019 UDP link remote: [AF_INET6]2a01:4f9xxxxx:1194
Mon Sep 30 12:03:08 2019 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
Mon Sep 30 12:03:08 2019 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Mon Sep 30 12:03:08 2019 [pdm.eauzon.be] Peer Connection Initiated with [AF_INET6]2a01:4f92a01:4f9xxxxx:1194
Mon Sep 30 12:03:10 2019 open_tun
Mon Sep 30 12:03:10 2019 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{FCE89304-5913-4884-B6BD-xxx}.tap
Mon Sep 30 12:03:10 2019 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.255.6/255.255.255.252 on interface {FCE89304-5913-4884-B6BD-3EEC32CE390C} [DHCP-serv: 192.168.255.5, lease-time: 31536000]
Mon Sep 30 12:03:10 2019 Successful ARP Flush on interface [34] {FCE89304-5913-4884-B6BD-xxx}
Mon Sep 30 12:03:10 2019 Blocking outside dns using service succeeded.
Mon Sep 30 12:03:15 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Sep 30 12:03:15 2019 Initialization Sequence Completed
But while i connect to the subnet servers i can no longer browse to other websites.
What is going wrong ?
