OpenVPN Server only for the internal network

BerndM

Hello,

I will install and configure an OpenVPN server on debian which the client have only access to the internal network and not to the internet over the VPN connection. At the moment use the client the VPN connection for all trafic, local and internet.

I use the description for the configuration from this https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-10 site.

port 443
proto tcp
dev tun
ca ca.crt
cert vpn-server.crt
key vpn-server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "dhcp-option DNS 192.168.7.2"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 0

My client configuration is:

client
dev tun
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

The login works without problems, only the routing to the internet from the client goes over the VPN and this is what I not will.

After connection I have the following routing on the client:

root@vpn-client:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s3: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 08:00:27:a3:e2:31 brd ff:ff:ff:ff:ff:ff
3: wlxd03745156409: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether d0:37:45:15:64:09 brd ff:ff:ff:ff:ff:ff
    inet 192.168.179.21/24 brd 192.168.179.255 scope global dynamic noprefixroute wlxd03745156409
       valid_lft 14486sec preferred_lft 14486sec
    inet6 2003:f5:1720:a001:7554:7d6b:b54b:fd96/64 scope global dynamic noprefixroute 
       valid_lft 6742sec preferred_lft 1342sec
    inet6 fe80::12c4:697e:3493:d2b/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.0.6 peer 10.8.0.5/32 brd 10.8.0.6 scope global noprefixroute tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::8293:ed54:9186:eaa8/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
root@vpn-client:~# route -n
Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        0.0.0.0         UG    50     0        0 tun0
0.0.0.0         192.168.179.1   0.0.0.0         UG    600    0        0 wlxd03745156409
10.8.0.1        10.8.0.5        255.255.255.255 UGH   50     0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    50     0        0 tun0
84.167.67.181   192.168.179.1   255.255.255.255 UGH   600    0        0 wlxd03745156409
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlxd03745156409
192.168.179.0   0.0.0.0         255.255.255.0   U     600    0        0 wlxd03745156409
192.168.179.1   0.0.0.0         255.255.255.255 UH    600    0        0 wlxd03745156409

I think that the first entry in the routing table is not correct for my.

When I correct it manually with the following commands, than works it correct:

route del default gw 10.8.0.5 dev tun0
route add -net 192.168.7.0 netmask 255.255.255.0 gw 10.8.0.5 dev tun0
route -n
Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.179.1   0.0.0.0         UG    600    0        0 wlxd03745156409
10.8.0.1        10.8.0.5        255.255.255.255 UGH   50     0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    50     0        0 tun0
84.167.67.181   192.168.179.1   255.255.255.255 UGH   600    0        0 wlxd03745156409
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlxd03745156409
192.168.7.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.179.0   0.0.0.0         255.255.255.0   U     600    0        0 wlxd03745156409
192.168.179.1   0.0.0.0         255.255.255.255 UH    600    0        0 wlxd03745156409

What is my failure? What mus I other configure on the VPN server that the routing from the client to the internet not goes over the VPN line?

Thanks for our help,
Bernd

fil

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

300000

There is no push "redirect-gateway local def1 " but somewhow your client still go over vpn it seem strange but you can adding this line so there will be sure client will never go over vpn at all . openvpn config and add this one in that is all done for you

push " route 0.0.0.0 192.0.0.0 net_gateway "
push " route 64.0.0.0 192.0.0.0 net_gateway "
push " route 128.0.0.0 192.0.0.0 net_gateway "
push " route 192.0.0.0 192.0.0.0 net_gateway "