Client to Internal Server VPN to External VPN

lala

(I have edited this post to try and make the example more clear)

Please help :-)

Goal

Give users the option to use the default router (192.168.1.1) to access the internet or they can chose to connect up to 192.168.36.100 and use the internet via the BolehVPN connection.

Setup

I have the following setup

                     {192.168.1.1/255.255.255.0}           {PUBLIC IP}
192.168.1.152(Client) <----------> [b]Router [/b]<------------> Internet
                                    |
                                    |
                            192.168.1.150 (Client)
                                    |
                  Private VM (Win2k3) With a NAT Ethernet Interface  
                  Subnet: 192.168.36.0 255.255.255.0
                  GW: 192.168.36.2
                                    |
                                    |
                            192.168.36.100 (Private VM client)
                              {Tap1 - Server}
                              {Tap2 - BolehVpn Client Connection}

I have created a NAT entry on the 192.168.36.0 interface which forwards all request on port 1194 to 192.168.36.100

e.g. Host:1194 IP:192.168.36.100 Private:1194

192.168.36.100

Eth: 192.168.36.100 (GW:192.168.36.2)
Tap1: 10.8.0.0 255.255.255.0 (OpenVpn server)
Tap2: Dynamic IP and Gateway (BolehVPN based on OpenVpn client config)

Tap1 Server config listens for requests on port 1194 on 192.168.36.100 in tunnel mode.

Tap2 is a BolehVpn uses client connection conf which runs in tunnel mode.

HELP

When I start up ONLY Tap1 (my custom OpenVpn server) clients can connect and it all works fine.

e.g. 192.168.1.152 can successfully connect and interact with 192.168.36.100 and a tunnel VPN connection is established

When I start up Tap2, the BolehVpn connects to its servers and the tunnel is created and that is working fine.

HOWEVER, now all connections to TAP1 fail. The TLS authentication cannot be completed. The Tap1 server log shows that requests were made but it did not get a valid connection (same with the client who is attempting the connection).

e.g. Client 192.168.1.152 attempts to connect up to 192.168.36.100 on port 1194 and cannot (but it can if Tap2 is not running).

I know it is a routing issue but I cannot find a way around it or if I am just doing everything wrong and there is simpler way.

Like maybe I can convert the BolehVpn client configs into a server/client config file which waits for connections and can make a connection to a server.

Mimiko

Not quite clear with that thextual diagram, but, the computer in the middle have to be an OpenVPN server for VPN1 and an OpenVPN client for VPN2.
When setting this computer as OVPN server use 'push "redirec-gateway def1"'. When creating OVPN server for VPN2 there also use 'push "redirect-gateway def1"'. The only thing you have to worrie is kipping the route for incoming port of OVPN not thru tunnel. For that, you have to know the IP from which client for VPN1 will connect.

lala

Thank you for you reply.

The incoming connection attempt from the client is the one causing my issues.

When the VPN2 Client Connection is on, all incoming traffic is re-routed to VPN2, including the initial handhshake connection attempt between client and VPN1.

On a windows server 2003 machine how would I make the Client VPN2 connection not re-rout the initial connection attemp to VPN1 from a client PC.

VPN1 SERVER OVPN

local 192.168.36.50
port 1194
proto udp
dev tun
dev-node ServerTap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway local def1"
keepalive 10 120
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3

VPN2 CLIENT OVPN (I have no control over VPN2 Server)

client
dev tun
proto udp
route-method exe
route-delay 3

remote XX.XX.XX.XX 443
remote XX.XX.XX.XX 443
remote XX.XX.XX.XX 443

remote-random
resolv-retry 10
nobind
persist-key
keepalive 3 10
ns-cert-type server
verb 1
mute 20
ca ca.crt
cert ajudicator.crt
key ajudicator.key

Mimiko

route add a.b.c.d mask 255.255.255.255 GW_IP if IF_Number

where a.b.c.d is external IP of the client that makes a VPN1 connection. GW_IP is the server's gateway. IF_number is interface number.

lala

Hey, I have tried to add static routes and I have not had a successful connection.

Ill try and be more clear on whats going on and what I would like to achieve.

I am running an open VPN server which is also running a VPN Client connection, which is connecting to an external VPN server.

     -------------------------------     VPN2 CLIENT
     | VPN1 SERVER  + VPN2 CLIENT|     --------->  (TUNNEL)  VPN2 SERVER
     -------------------------------     INTERNET

The idea being if anyone connects to VPN1, all their traffic is routed down to VPN2.

  
  --------------------------------
  |CLIENT 1 - CONNECTS TO VPN1|
  --------------------------------
                   | tunnel 
                   V
 ---------------------------     VPN2 CLIENT
 | VPN1 SRV + VPN2 CLIENT |   --------->  (TUNNEL)  VPN2 SRV
 |    TAP1             TAP2  |     internet
  ---------------------------

Issue: When VPN2 Client is connected, connections attempts to VPN1 fail due to a TLS error. This is a routing issue as connection response is no going back to CLIENT 1

At the moment, both TAP1 and TAP2 are running on one NIC (ethernet adapter).

Maybe a solution to my issue is 2 install a second NIC (ethernet adapter) and have all VPN1 connections directed at NIC 2, while the VPN2 Client connection (TAP2) is running through NIC1.

Then I will rout all traffic from NIC2 to NIC1 which theoritically should get pushed down to VPN2.

However, when I make a connection using the VPN2 client settings, it runs on ALL ethernet adapters.

The question I have is, how do I tell a client ovpn to ONLY direct its connection and tunelling to a specific NIC/ethernet adapter such as NIC2.

I am not even sure what I am trying to accomplish is possible or maybe I am going about this the wrong way.

Any help would be hugely appreciated guys.

Cheers

The only way I can summarize this is like this:

MY NETWORK                MY  SERVER               
CLIENT VPN1 ->  [VPN1 SRV  + VPN2 CLIENT] -> VPN2 SRV

lala

Please someone lol

There has to be someone that has attempted and successfully done what I am attempting to do.

Basically I am trying to forward traffic from one vpn client (1st client) to vpn server through to another client vpn (2nd client) connection to another vpn server.

The only issue I am having is, when the 2nd client connection is connected, no clients can connect to the 1s VPN server because the connection handshake fails.

I can see the attempt is made (on the 1st VPN server) and acknowledged but the response is not sent back.

There must be away to tell the VPN server to rout traffic back through the original gateway and NOT use the new tunnel created gateway.

l

lala

Please help :-)

Goal

Give users the option to use the default router (192.168.1.1) to access the internet or they can chose to connect up to 192.168.36.100 and use the internet via the BolehVPN connection.

Setup

I have the following setup

                     {192.168.1.1/255.255.255.0}           {PUBLIC IP}
    192.168.1.152 <----------> [b]Router [/b]<------------> Internet
                                    |
                                    |
                            192.168.1.150
                                    |
                  Private VM (Win2k3) With a NAT Ethernet Interface  
                  Subnet: 192.168.36.0 255.255.255.0
                  GW: 192.168.36.2
                                    |
                                    |
                            192.168.36.100

lala

Please help.

I have been trying to do somthing that I would think would be pretty straightforward but am running into connection issues.

My First post has been re-edited to give a clearer outline of what I am trying to do, but basically all I am trying to do is allow clients to connect up to an internal vpn server, which in turn is connected to an external VPN server.

All traffic is just pushed from the internal VPN server to the external VPN server.

The only issue I am having is, when the external VPN server is connected, internal clients cannot connect to the internal VPN server.

I have an idea why, but I am a nub at windows routing rules and dont really know where to start.

Any help of direction would be appreciated.

Cheers

l

lala

OMG

Im a real nub and am happy to admit it.

Mimiko was right all along, I just didnt understand how the route commands worked.

I think I have finally achieved what I wanted to.

Thanks M

l

Mimiko

Glad to hear that you solved the problem while I was at journey. :lol: