My OpenVPN server has 2 network interfaces. One is open to the internet, while the other is internal.
I want users to be able to connect and access devices on the internal network, while using internet access from the external connection.
I've setup the server using:
https://github.com/Nyr/openvpn-install
Client will connect, has internet access, but cannot reach devices on internal network (10.12.0.0).
Clients can ping the internal gateway 10.12.0.1 but can get no further.
+---OpenVPN_Server---+
+---Internal Network---+ | |
| 10.12.0.0/24 | | ens192 |
| gw: 10.12.0.1 +--------+ ip: 10.12.0.54 |
+----------------------+ | | +-Internet_Access-+
| ens224 | | |
| ip: 19.24.98.18 +-------+ gw: 19.12.98.1 |
+--------------------+ +-----------------+
server.conf
note: 10.12.0.45 is dns server on internal network.
local 19.24.98.18
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.12.0.45"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
push "route 10.12.0.0 255.255.255.0"
keepalive 10 120
/etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug ens192
iface ens192 inet static
address 19.24.98.18/27
gateway 19.24.98.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 10.12.0.45 1.1.1.1 1.0.0.1
dns-search corp.cswi.com
# The secondary network interface
allow-hotplug ens224
iface ens224 inet static
address 10.12.0.54/24
post-up ip route add 10.12.0.0/24 dev ens224 src 10.12.0.54 table rt2
post-up ip route add default via 10.12.0.1 dev ens224 table rt2
post-up ip rule add from 10.12.0.54/32 table rt2
post-up ip rule add to 10.12.0.54/32 table rt2
/etc/iproute2/rt_tables
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
1 rt2
iptables -t nat -v -L -n --line-number
hain PREROUTING (policy ACCEPT 362 packets, 36616 bytes)
num pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 362 packets, 36616 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 34 packets, 2458 bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 34 packets, 2458 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 SNAT all -- * * 10.8.0.0/24 !10.8.0.0/24 to:19.24.98.18
iptables -v -L -n --line-number
Chain INPUT (policy ACCEPT 1848 packets, 187K bytes)
num pkts bytes target prot opt in out source destination
1 217 49357 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT all -- * * 10.8.0.0/24 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 1238 packets, 139K bytes)
num pkts bytes target prot opt in out source destination
