rudepeople I know this has been covered numerous times, but my use case seems to be a little unique. I have openvpn installed on debian (buster) in a VM (ESXi). I used https://www.cyberciti.biz/faq/debian-10-set-up-openvpn-server-in-5-minutes/]a script[/url] to get it going and everything works as desired, but for one thing; everyone connecting to the VPN is routing internet traffic over the VPN... the purpose of this VPN is to give access to network resources (shared folders and such) to remote users, but we don't want them streaming netflix over the vpn! when the script setup the server it used the lines below [oconf]push "dhcp-option DNS 192.168.24.18" push "dhcp-option DNS 192.168.0.12" push "redirect-gateway def1 bypass-dhcp"[/oconf] as I read it in the howto guides and a couple of google searches. this is the cause of my issues. I believe I need to comment out those lines (or delete them) then add the following lines to the client config files [oconf]route 192.168.21.0 255.255.255.0 vpn_gateway route 192.168.22.0 255.255.255.0 vpn_gateway route 192.168.23.0 255.255.255.0 vpn_gateway route 192.168.24.0 255.255.255.0 vpn_gateway route 192.168.25.0 255.255.255.0 vpn_gateway[/oconf] (NOTE: we have 5 vlans in the network with resources users need access to... well they only need access to two vlans, but _I_ need all 5 as the sysadmin) The trouble is, when I make this change, while local/internet traffic redirects correctly to the local network, the tunnel traffic hits the vpn server and stops! I can ping 10.8.0.1 (openvpn server) but I cant ping 192.168.21.4 (address of the server itself) or 192.168.21.1 (router) much less anything else in the network. of course if I remove the route lines in the client config and reenter the push dhcp/redirect-gateway lines, I can connect to the vpn and ping all the resources over the VPN as desired, but when I do a tracert on www.google.com, I'm redirecting internet traffic over the VPN too... so I think one of the other config lines is the culprit... right? heres my server config: [oconf]port 1194 proto udp dev tun user nobody group nogroup persist-key persist-tun keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option DNS 192.168.24.18" push "dhcp-option DNS 192.168.0.12" push "redirect-gateway def1 bypass-dhcp" dh none ecdh-curve prime256v1 tls-crypt tls-crypt.key 0 crl-verify crl.pem ca ca.crt cert server_K13oR1PQSQfzrdM2.crt key server_K13oR1PQSQfzrdM2.key auth SHA256 cipher AES-128-GCM ncp-ciphers AES-128-GCM tls-server tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 status /var/log/openvpn/status.log verb 3[/oconf] and one of the client configs (remote IP is a dummy): [oconf]client proto udp remote 10.10.10.1 1194 dev tun resolv-retry infinite nobind persist-key persist-tun #route 192.168.21.0 255.255.255.0 vpn_gateway #route 192.168.22.0 255.255.255.0 vpn_gateway #route 192.168.23.0 255.255.255.0 vpn_gateway #route 192.168.24.0 255.255.255.0 vpn_gateway #route 192.168.25.0 255.255.255.0 vpn_gateway remote-cert-tls server verify-x509-name server_K13oR1PQSQfzrdM2 name auth SHA256 auth-nocache cipher AES-128-GCM tls-client tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 #setenv opt block-outside-dns # Prevent Windows 10 DNS leak verb 3[/oconf]
TinCanTech rudepeople wrote I used a script to get it going Please consult the author of your script. configuration
