Routing configuration help required.

mxjninja

Hi OpenVPN fellow,

remote user ---> openvpn server ---> LAN webserver

Is there a way for the applications for example LAN webserver to see the remote user’s private ip address (vpn client private ip) while connected instead of openvpn server IP hit its ?

Thanks

TinCanTech

Read the howto.

mxjninja

TinCanTech wrote Read the howto.

I appreciate if you could point on which one. i did read but quite blurr which one

TinCanTech

One might imagine a ninja could find the official openvpn howto without pleading for assistance ...

mxjninja

hehehe. oh ok. tq for the motivation. 🙂

mamelf

I am trying thre same configuration as your are, but I have recevied the same solution. Perhaps we have to look for a solution in any web wich explain the solution to the people who doesn´t know the solution. It´s a pitty that you and me couldn´t try to solve our problems togethe, but please, continue working!!!!! Yes we can!!

TinCanTech

If your server uses Linux, try a script such as Nyr/openvpn-install or angristan/openvpn-install

mxjninja

TinCanTech wrote If your server uses Linux, try a script such as Nyr/openvpn-install or angristan/openvpn-install

i use angristan actually, but i think my question is not right or lead to miss understanding question.

im not sure what i try to explain is correct or not, since i use tun, so all vpn ip will be nat to physical ip. i have no issue to access others LAN network, but for there is a problem, where others webservers in LAN, will detect vpn server IP instead of VPN subnet ip assign to client 10.8.0.x.
as you suggest, read the how to, this easily solve if i use tap, but im not prefer to use it. im still try to find out the routing things if want use tun.
if is not possible to be done, appreciate if you could let me know. hahaha.

for workaround solution, i just install squid make it as transparent proxy, at least i can see which vpn client access the internal webserver.

Thanks,
mXj

TinCanTech

mxjninja wrote i use angristan

Then this is why you cannot get the solution you desire.

mxjninja wrote im not sure what i try to explain is correct or not, since i use tun, so all vpn ip will be nat to physical ip. i have no issue to access others LAN network, but for there is a problem, where others webservers in LAN, will detect vpn server IP instead of VPN subnet ip assign to client 10.8.0.x.

This is exactly what NAT does.

mxjninja wrote as you suggest, read the how to, this easily solve if i use tap, but im not prefer to use it. im still try to find out the routing things if want use tun.

You will have to disable NAT which is installed by angristan. You do not need tap.

mxjninja wrote if is not possible to be done, appreciate if you could let me know

It can be done and is clearly documented in the howto but you will need to change the angristan settings and on that I cannot help you.

mxjninja wrote for workaround solution, i just install squid

What ever works for you is best until you learn how to use routing.

mxjninja

mamelf wrote I am trying thre same configuration as your are, but I have recevied the same solution. Perhaps we have to look for a solution in any web wich explain the solution to the people who doesn´t know the solution. It´s a pitty that you and me couldn´t try to solve our problems togethe, but please, continue working!!!!! Yes we can!!

Hi,

if you are looking for solution like me here we goes.

if you using NAT, please remove it.

inside destination LAN device you want to access. you have to create route
example
ip route del 10.8.0.0/24 via 192.168.0.x(x is your openvpn physical ip)

and inside server.conf you can use push "route 192.168.0.0 255.255.255.255"

Thanks,
mXj

TinCanTech

mxjninja wrote and inside server.conf you can use push "route 192.168.0.122 255.255.255.0"

That is an invalid route.

mxjninja

ohh typo error. hehehe

.255 instead

TinCanTech

Openvpn treats a missing netmask as a host mask, which means this would also be correct:

push "route 192.168.0.122"

TinCanTech

However, IPv6 is a world of pain mofo :mrgreen:

300000

If you want client lan can see client remote ip just add this line on your server config so all ip can see

client-to-client