cyungle
I have a scenario that I have been unable to find a suitable configuration for because none of the configurations from the HOWTO guides apply.
I want to create a client -> server, "reverse road warrior" configuration where the server needs to access the LAN where the client resides, rather than the other way around.
1. Client is behind a firewall, not Internet accessible
2. Server is Internet accessible
3. Once client establishes connection to server, server needs to be able to access client's LAN
I tried putting the server behind the firewall but there is no way for an external client to reach it. It isn't possible in this configuration to put a NAT redirection on the external firewall; connection has to be initiated by the internal component.
I tried applying IPTABLES rules for redirection on the client to internal subnets and routing instructions on the server for how to use the tunnel interface to do so but nothing has worked so far.
Is there a configuration that someone has successfully implemented that can help me?
Thanks
maikcat
hi there,
seems to me like basic lan-to-lan scenario but without
pushing routes from the server internal lan to your clients.
the problem is that you MUST assosiate certificates given to your clients
with their lan range ips.
that means that you MUST know what network each of your clients has.
the server must have static ip and firewall configured to accept incoming connection
to the openvpn service.
if i undestood wrong please let me know.
Michael
cyungle
I am not sure what you mean by "basic lan-to-lan" but I suspect it is either a routed or bridged solution. Either may work in my situation but neither seem to fit the idea of a server reaching subnets behind a client. All of the configurations that I have seen either allow a client to reach subnets behind a server or allow other clients in the client subnet to use the tunnel to reach the server. What I am trying to do is allow the server to reach the client's subnet.
About certificates: I have generated certificates for both the server and the client and they work fine for the initial negotiation. I didn't see any discussion about associating the certificates with a given client so I am not sure what you are referring to.
About the server: The server's firewall is configured to receive connection requests from the client and that works fine. The client connects to and negotiates with the server. The server and client can ping each other and connect to each other's ports.
What doesn't work is the server cannot reach anything beyond the client's IP address. I created routes on the server so it knows what gateway to use (the server's tun0 IP) to reach the client's subnet, and also created IPTABLES rules on the client to forward the server's traffic from the client's tun0 interface. Watching the traffic, it seems that any traffic from the server, other than the client's tun0 IP, doesn't go anywhere.
I suspect that this is a routing issue but don't know if it may be a feature of openvpn that is preventing the server's ability to route traffic through it's tun0 interface to the client.
Any ideas?
Thanks - k
cyungle
The problem involved forwarding the traffic on the client machine coming from the server. I wasn't using the right MASQ directives for IPTABLES but once I did, the traffic forwarded correctly.
[client]# iptables -t nat -A POSTROUTING -s 10.1.0.1 -o eth0 -j MASQUERADE
10.1.0.1 being the tun address coming from the openvpn server
maikcat
please post configs of server and one client
and we will help you out.
Michael.
