rudepeople
I know this has been covered numerous times, but my use case seems to be a little unique.
I have openvpn installed on debian (buster) in a VM (ESXi). I used https://www.cyberciti.biz/faq/debian-10-set-up-openvpn-server-in-5-minutes/]a script[/url] to get it going and everything works as desired, but for one thing; everyone connecting to the VPN is routing internet traffic over the VPN...
the purpose of this VPN is to give access to network resources (shared folders and such) to remote users, but we don't want them streaming netflix over the vpn!
when the script setup the server it used the lines below
push "dhcp-option DNS 192.168.24.18"
push "dhcp-option DNS 192.168.0.12"
push "redirect-gateway def1 bypass-dhcp"
as I read it in the howto guides and a couple of google searches. this is the cause of my issues. I believe I need to comment out those lines (or delete them) then add the following lines to the client config files
route 192.168.21.0 255.255.255.0 vpn_gateway
route 192.168.22.0 255.255.255.0 vpn_gateway
route 192.168.23.0 255.255.255.0 vpn_gateway
route 192.168.24.0 255.255.255.0 vpn_gateway
route 192.168.25.0 255.255.255.0 vpn_gateway
(NOTE: we have 5 vlans in the network with resources users need access to... well they only need access to two vlans, but _I_ need all 5 as the sysadmin) The trouble is, when I make this change, while local/internet traffic redirects correctly to the local network, the tunnel traffic hits the vpn server and stops! I can ping 10.8.0.1 (openvpn server) but I cant ping 192.168.21.4 (address of the server itself) or 192.168.21.1 (router) much less anything else in the network. Of course if I remove the route lines in the client config and re-enter the push dhcp/redirect-gateway lines, I can connect to the vpn and ping all the resources over the VPN as desired, but when I do a tracert www.google.com, it hits 10.8.0.1 before heading out indicating I'm redirecting internet traffic over the VPN too...
so I think one of the other config lines is the culprit... right?
heres my server config:
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.24.18"
push "dhcp-option DNS 192.168.0.12"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_K13oR1PQSQfzrdM2.crt
key server_K13oR1PQSQfzrdM2.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
and one of the client configs (remote IP is a dummy):
client
proto udp
remote 10.10.10.1 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
#route 192.168.21.0 255.255.255.0 vpn_gateway
#route 192.168.22.0 255.255.255.0 vpn_gateway
#route 192.168.23.0 255.255.255.0 vpn_gateway
#route 192.168.24.0 255.255.255.0 vpn_gateway
#route 192.168.25.0 255.255.255.0 vpn_gateway
remote-cert-tls server
verify-x509-name server_K13oR1PQSQfzrdM2 name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
#setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
300000
if you only need client routing only vlan and server vpn subnet over vpn link just add this in your client.
route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway
your client can access 5 vlan and openvpn server subnet only , everything will go client network gateway
