Hello,
I am using an AWS always free tier EC2 VPS with OpenVPN for port 80/443 traffic forwarding to the client, which is a NextCloud server running at my home behind a CG-NAT ISP.
I am using this (
https://git.io/vpn) setup script for OpenVPN installation in AWS (Ubuntu 20) along with client configuration file creation. Works perfectly fine for OpenVPN installation, client configuration creation along with tunnel setup.
Further, I use the client config directory method in OpenVPN server to assign a static VPN IP to my respective client and add this following code in IP table for incoming traffic redirection (forwarding) via VPN and gets the response (NextCloud Service) back and can use it flawlessly.
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.100:443
Works cool, anyone trying to access the AWS VPN IP ends up at my Home Server.
But there is a problem. This script is designed to route all internet traffic of clients to go via the VPN server. But I don't need that, beside it unnecessarily consumes a lot of AWS bandwidth. So I am looking for a method to keep this VPN to client incoming redirection working but client can access the internet via it's local network.
Here is an article (
https://openvpn.net/community-resources/how-to/#redirect) suggesting commenting out the following line in server configuration to stop client internet traffic to redirect via VPN Server.
push "redirect-gateway def1"
If I do that, I see my client is able to connect to VPN and obtain the IP but the 80/443 port direction isn't working anymore.
Here are my configurations,
Server Configuration,
local 172.xx.xx.xxx
port 331
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
client-config-dir /etc/openvpn/ccd
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
sndbuf 0
rcvbuf 0
push "sndbuf 0"
push "rcvbuf 0"
#push "redirect-gateway def1 bypass-dhcp" <-- Commenting out breaks the setup
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
My Client Configuration,
client
dev tun
proto udp
remote xx.xx.xx.xxx 331
resolv-retry infinite
nobind
sndbuf 0
rcvbuf 0
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
ca
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>
Can anyone please help me to get this setup running?
Thanks.
