2sIxPPDtH1oxfwj
I have a linux machine that runs an openvpn server. The same computer also connects to a third party vpn provider using openvpn.
The openvpn server is set to tun3 and the openvpn client is set to tun0. I have a port forwarding rule that allows me to connect to 1194 from the internet to my linux machine.
I would like to be able to connect externally to tun3 and be able to access resources on my lan. But I would also like all internet traffic to go via the third party vpn provider whilst I'm connected to tun3.
192.168.50.56 - linux machine
192.168.50.0/24 - lan network
192.168.51.0/24 - open vpn server network
I managed to get this working in the past but recently its stopped working. I'd like to think that theres a less hacky way of achieving this and the openvpn gurus on this forum will be able to assist 😉. Below are some bits of config I have from the machine.
If you have any further questions please let me know.
port 1194
proto udp
dev tun3
local 192.168.50.56
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/a.crt
key /etc/openvpn/certs/a.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0
server 192.168.51.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 192.168.50.0 255.255.255.0"
push "route 192.168.51.0 255.255.255.0"
client-to-client
cipher AES-256-CBC
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AE
S-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
#log /var/log/openvpn.log
#status /var/log/openvpn-status.log
verb 5
mute 50
client-config-dir /etc/openvpn/ccd
route 192.168.51.0 255.255.255.0
reneg-sec 43200
ping 60
client
dev tun
proto udp
remote a.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass a.conf
comp-lzo no
verb 1
reneg-sec 0
crl-verify /etc/openvpn/client/a.pem
ca /etc/openvpn/client/a.crt
disable-occ
auth-nocache
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
#For OpenVPN
iptables -A INPUT -i tun+ -j ACCEPT -m comment --comment "For OpenVPN"
iptables -A FORWARD -i tun+ -j ACCEPT -m comment --comment "For OpenVPN"
iptables -A FORWARD -s 192.168.51.0/24 -j ACCEPT -m comment --comment "For OpenVPN"
iptables -A FORWARD -s 192.168.50.0/24 -j ACCEPT -m comment --comment "For OpenVPN"
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "For OpenVPN"
iptables -t nat -A POSTROUTING -s 192.168.51.0/24 -j SNAT --to-source <external dns name> -m comment --comment "For OpenVPN"
iptables -t nat -A POSTROUTING -s 192.168.51.0/24,192.168.50.0/24 -o enp0s31f6 -j MASQUERADE -m comment --comment "For OpenVPN"
# Masquerade.
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
# fowarding
iptables -A FORWARD -i tun0 -o tun3 -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i tun3 -o tun0 -j ACCEPT
iptables -P FORWARD DROP
