Routing Questions

ExEric3

Hello,

here is my description of my network configuration.

My home router with two physical network adapters:
Internet adapter: IP: 95.105.133.92 Mask: 255.255.255.0 Gateway: 95.105.133.1
LAN adapter: IP: 192.168.28.1 Mask: 255.255.255.0
OpenVPN Tap Adapter: IP: 10.20.10.1 Mask: 255.255.255.252

My question is: Allowing clients connecting on OpenVPN and browsing web, playing games over IP 95.105.133.92.

VPN Clients get IPs: 10.20.10.20 - 10.20.10.40

I tried some examplex which I found on internet but without any result. This was my last settings which didnt worked:

push "redirect-gateway"
push "route 192.168.28.0 255.255.255.0"

Of course I want see computers on both networks. client-to-client is enabled also.

Any ideas or some example config? I know this maybe was discussed many times but I dont know imagine it on my own model.

Thanks for yours time and answer. :roll:

krzee

what OS is your router, or server?
one of them needs to NAT the vpn traffic...
for a basic iptables NAT where 10.8.0.x is the vpn network:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

to choose what IP address to NAT as, you can use

iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>

http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info

ExEric3

krzee wrotewhat OS is your router, or server?
one of them needs to NAT the vpn traffic...
for a basic iptables NAT where 10.8.0.x is the vpn network:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

to choose what IP address to NAT as, you can use

iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>

http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info

Here is my server config:

# server
mode server
tls-server
port 443
proto tcp-server
dev tap
dev-node OpenVPN
ifconfig 10.20.10.100 255.255.255.0
ifconfig-pool 10.20.10.10 10.20.10.50 255.255.255.0
push "route 192.168.28.0 255.255.255.0 10.20.10.100"
push "route-gateway def1 bypass-dhcp"
push "dhcp-option DNS 87.118.114.9"
push "dhcp-option DNS 81.27.192.33"
client-to-client
duplicate-cn
ca ca.crt
cert Atom.crt
key Atom.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt
status openvpn-status.log
keepalive 10 120
tls-auth ta.key 0
comp-lzo
verb 3

Its PC connected directly to fiber optic converter and with two physical network cards. First is for converter and second is for my internal LAN. OS is Windows Server 2003 and as router, firewall and antivirus is used Kerio Winroute. Behind this server are 3 computers on that 192.168.28.1 network.

And my question is: allow joining VPN clients on OpenVPN Server and at least allowing browsing websites over my public IP 95.105.133.92. Also will be nice if that VPN Clients will see other computers behind that server.

Is that possible? Or at least tell me what put to that config? 😉

Thank you.

sonlas7y20

By allowing your other VPN clients to surf the web, you mean using your server as a proxy server?
if so, then server configuration side has a proxy configuration part.
I assume you would have to install some proxy on your server kind of like Squid or some other.

ExEric3

sonlas7y20 wroteBy allowing your other VPN clients to surf the web, you mean using your server as a proxy server?
if so, then server configuration side has a proxy configuration part.
I assume you would have to install some proxy on your server kind of like Squid or some other.

No. I dont want it via proxy server. I already saw OpenVPN Server which redirect all communication over their connection without any proxy settings.

ExEric3

Anyone with some ideas how allow that all traffic over VPN?

krzee

your entries in post #1 were correct, but you also need to NAT the VPN subnet like i said in my first reply.
Just to get some things straight...
The server is windows.
it is also the router for its lan?
192.168.28.0/24 is the server's LAN.

If all of the above are yes/true, all you need to clients to connect to the server LAN is the push route from post 1
the openvpn part of the config for redirecting client traffic over the vpn is
push "redirect-gateway" (you probably want push "redirect-gateway def1")
but then your OS needs to NAT the vpn subnet to the internet routable IP, and have ip forwarding enabled.
http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html

ExEric3

And what difference is between push "redirect-gateway" and push "redirect-gateway def1"?

What means that def1?

krzee

sorry for the slow response,
hopefully by now you thought to check the manual
http://openvpn.net/man-beta
under --redirect-gateway there is a list of flags, including def1