Need help with Split-tunnel

dovla

Hi,

since I come from the ASA world, and I have limited knowledge with OpenVPN, I will need some help setting Split-Tunnel.
current config I have inherited so I cannot comment if something is good or not...

What I want to achieve is:

I have my home network 192.168.2.0/24, and office network 123.123.123.0/24. VPN tunnel internal IP is 10.0.0.0/24
Currently I can connect to office network VPN without any issues, and get all resources which I need, but I found out that all traffic is routed there.
So if I want to download lets say new version of CentOS for my home laptop, all traffic is going through 123.123.123.0/24 network tunneled to my 192.168.2.0/24

What I would like is that anything that is not going via 123.123.123.0/24 is going to my own home network, and only traffic which is meant for 123.123.123.0/24 is going through VPN

So plain old split tunnel.

# OpenVPN Port, Protocol and the Tun
port 1194
proto udp
dev tun

# OpenVPN Server Certificate - CA, server key and certificate
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/cert.crt
key /etc/openvpn/server/key.key

#DH and CRL key
dh /etc/openvpn/server/dh.pem
crl-verify /etc/openvpn/server/crl.pem

# Network Configuration - Internal network
# Redirect all Connection through OpenVPN Server
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"

# Using the DNS from https://dns.watch
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"

#Enable multiple client to connect with same Certificate key
duplicate-cn

# TLS Security
cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-xxx-xxx-xxx-xxx-xxx-xxx...xxx
auth SHA512
auth-nocache

# Other Configuration
keepalive 20 60
persist-key
persist-tun
comp-lzo yes
daemon
user nobody
group nobody

# OpenVPN Log
log-append /var/log/openvpn.log
verb 3

client
dev tun
proto udp

remote 123.123.123.1 1194

ca ca.crt
cert client.crt
key client.key
remote-cert-tls server

cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-xxx-xxx-xxx-xxx...xxx

resolv-retry infinite
compress lzo
comp-lzo
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3

so, what I need to change to be able to pass only traffic meant for office network and everything else via my home gateway?

P.S. It would be best if it is possible to do an override on client config...

Pippin

See

--push option

and

--redirect-gateway flags...

in manual 2.4:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

dovla

Great now I just need to decipher OpenVPN manual page and find out how it is used. Is this for the Server config or Client, which flags, route etc... Again, I am not whit in terms of OpenVPN configuration... :-(

Pippin

Did not notice this

It would be best if it is possible to do an override on client config...

In that case, see
--pull-filter
in manual 2.4:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

PS
I also forgot to mention

----dhcp-option type [parm]

TinCanTech

dovla wrote I have inherited so I cannot comment if something is good or not

Which means this is now your job.

dovla wrote I have limited knowledge with OpenVPN

Which is why we wrote the Howto.

dovla wrote what I need to change to be able to pass only traffic meant for office network and everything else via my home gateway?

This is exactly documented in the Howto:

You need this:
https://community.openvpn.net/openvpn/wiki/HOWTO#IncludingmultiplemachinesontheserversidewhenusingaroutedVPNdevtun

Not this (which you currently have):
https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

dovla

from HowTo, I found this line: "This can easily be done with the following server-side config file directive:"
So it is not possible to set some config on the client config? Also I am not certain if we understood each other.
One of the quote: "Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself."

When I established connection from client to VPN network (server network), I can already get all those servers/services in that same network. I do not need that my client is reachable in the opposite way. What I need is from Client all traffic meant to Server network to go to server network. All other traffic from client which is accessing other services on the internet, that are not pushed via companies gateway, but my own home gateway.

Home PC -> (office data) -> Office VPN -> Office servers
Home PC -> (internet content such as Download or Youtube) -> Home Gateway

Brgds

300000

you can try this one add into client config and connect it again to see if this work for you not not

route  0.0.0.0 192.0.0.0 net_gateway 
route  64.0.0.0 192.0.0.0 net_gateway 
route  128.0.0.0 192.0.0.0 net_gateway 
route  192.0.0.0 192.0.0.0 net_gateway 
route 123.123.123.0 255.255.255.0 vpn_gateway

all this one will do the job you like to use internet as

Home PC -> (office data) -> Office VPN -> Office servers
Home PC -> (internet content such as Download or Youtube) -> Home Gateway