VPN Client IP not showing up in server logs...

john_es

I am trying to restrict access to certain apache sites on my VPN server to only users that are connected to the VPN. I can connect to the VPN just fine, and I can route all traffic over the VPN.

When I go to http://whatismyip.com I see the IP address of my VPN server (which is good).

When I look at the apache access logs though, instead of seeing my VPN-given IP address, I see my ISP's IP address (as in the IP address from http://whatismyip.com when not connected to the VPN).

Where should I be looking? What info can I provide to have someone be able to help?

Thanks,
John

john_es

This probably should get moved to the Configuration sub-forum...

Mimiko

Do you whant some users to to not access some sites on internet thru VPN tunnel, or some pages on same sarver where apache is installed? "apache sites" are ambiguos.

janjust

I am trying to restrict access to certain apache sites on my VPN server to only users that are connected to the VPN. I can connect to the VPN just fine, and I can route all traffic over the VPN.

so the apache servers are running on the same box as the VPN server right?
when an OpenVPN client connects a special route is set up directly to the OpenVPN server itself; this route is needed for the encrypted tunnel traffic to go the the OpenVPN server directly , i.e. outside of the tunnel. If this route was not there then all encrypted tunnel traffic would flow via the VPN tunnel, which means it gets encrypted again, and is then fed back into the tunnel etc - the classic 'biting your own tail' problem.

The result of this is that when you're connected to VPN server A.B.C.D and you then browse to website http://A.B.C.D is that this traffic is NOT sent over the VPN. In order to view the site via the VPN tunnel you must use http://VPN-SERVER-IP

If you cannot set this up for your websites then you have a serious problem.
If you can set this up, then bind apache to the VPN server IP instead of to the public IP of the server.

john_es

1.) I am talking about restricting access to certain pages on the same server (apache and openvpn are on the same box). For example, I have squirrelmail installed and want only users that are connected to VPN to be able to view that.

2.) Regarding this... What do you mean, exactly?

The result of this is that when you're connected to VPN server A.B.C.D and you then browse to website http://A.B.C.D is that this traffic is NOT sent over the VPN. In order to view the site via the VPN tunnel you must use http://VPN-SERVER-IP

So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)?

In other words, I MUST use the IP address of the site?

If you cannot set this up for your websites then you have a serious problem.
If you can set this up, then bind apache to the VPN server IP instead of to the public IP of the server.

What do you mean? How could I bind apache to the VPN server IP rather than the public IP? And could I have it set so that some apache sites on that server are accessible to everyone and some are restricted only to users connected to VPN?

Mimiko

So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)?

Yes. On every client a route to public IP of VPN server is added with mask 255.255.255.255 to external interface of client, in order not to lose connection with the VPN server itself. So every user will access apache service on your VPN server thru internet, not the tunnel, if client is using public IP. But this may be resolved like this:

In the OpenVPN server config use "client-connect" option to call a script, that will write to some file, for example "users_ip_deny", the public ip of the client from enviromental variable "trusted_ip" and VPN ip of the client from environment variable "ifconfig_pool_remote_ip" based on common name taken from environmental variable "common_name". Apache will have to use this file to determine from what IP some client accesses the web server and allow or deny access to pages.

Also, use "client-dissconect", to remove the unneeded ips from that file, specified by environmental variable like in previous paragraph.

This way you will limit users that will access apache service not only by typing your servers public IP, but also by typing servers VPN IP.

janjust

So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)?

if the VPN server and the web server are both running on X.X.X.X , then yes

In other words, I MUST use the IP address of the site?

no that is not required, but in general a domain name resolves to the same address, regardless of whether a VPN is used or not. This may the solution, BTW:

set up domain server on the VPN box for the VPN clients which resolves mydomain.com to the VPN IP address
push out this DNS domain server to the VPN clients
when a VPN client connects the address resolves to the VPN server IP and the connection flows via the VPN tunnel

What do you mean? How could I bind apache to the VPN server IP rather than the public IP? And could I have it set so that some apache sites on that server are accessible to everyone and some are restricted only to users connected to VPN?

you can bind apache to as many IPs as you like, for different websites (read up on 'VirtualHost').

john_es

I want to thank you guys for this... it has helped me understand the issues and gotten me to get google to give me some more answers.

If I set my Windows 7 hosts file to have:
10.8.0.1 mail.mydomain.com
I am able to connect to webmail when connected to VPN.

However if I remove that line, I cannot. So I must be missing something, the question is what...

I installed dnsmasq.

Config files:
/etc/openvpn/server.conf:
push "dhcp-option DNS 10.8.0.1"

/etc/dnsmasq.conf
server=/mydomain.com/10.8.0.1
listen-address=127.0.0.1,10.8.0.1
bind-interfaces

/etc/resolv.conf
domain mydomain.com
search mydomain.com
nameserver 127.0.0.1
nameserver 10.8.0.1
nameserver <ISPDNSIP>
nameserver <ISPDNSIP>

janjust

after openvpn connects, do a

net stop dnscache
net start dnscache

then type

nslookup mail.mydomain.com

if it then resolves correctly then you're running into a DNS caching issue (which is Windows specific). The solution for this is to add

register-dns

to the client configuration.

If not, then the problem lies elsewhere.

john_es

OK - did all that...

nslookup mail.mydomain.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 10.8.0.1

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

So, I'll track this down.

Another related question to a post up there... if I restrict access to 10.8. in my apache config, does that mean that if a person is connected to a different VPN and has an IP address of 10.8.0.x, that they would be able to connect to the page? If so, is there a way to restrict to only _my server's_ vpn?

janjust

what do you mean "a different VPN" ? the 10.x/8 address range is private and will not be routed by any internet provider - so if your server is receiving packets with source address 10.8.0.x then you can be certain that the packets are coming from *your* VPN - or you have a completely screwed internet provider.

john_es

I may have asked this question in a stupid way... and think I figured out what I was trying to ask...
Now, back to dnsmaq troubleshooting for me.

john_es

So, it looks as though I am stuck configuring dnsmasq. The few guides I find simply talk about installing it, but nothing as comprehensive as what needs to happen in terms of how to configure it for this situation. What I don't see, is how to get mydomain.com to resolve to the private VPN IP of 10.8.0.1 -- without overriding the Windows hosts file.

The

register-dns

thing works really well on my Windows client.

john_es

Ah, one problem was that I needed to open up port 53...
I did that and now get:

nslookup google.com
Server: UnKnown
Address: 10.8.0.1

Non-authoritative answer:
Name: google.com
Addresses: 74.125.225.52
74.125.225.48
74.125.225.49
74.125.225.50
74.125.225.51

I thought that would have solved my issue, but not quite yet.

john_es

OK - I updated my /etc/hosts file from this:

127.0.0.1     localhost localhost.localdomain
<MYPUBLICIP>     mydomain.com mydomain

to this:

127.0.0.1     localhost localhost.localdomain
<MYPUBLICIP>     mydomain.com mydomain
10.8.0.1 mydomain.com mail.mydomain.com mydomain

Pinging mail.mydomain.com shows an IP of 10.8.0.1, while pinging mydomain.com shows the public IP of the server. Not sure off the top of my head how to solve that, but it's really not a big issue at this point.

I really appreciate the help...

john_es

Coming back to this after I had to re-build my machine...

My config files:

/etc/dnsmasq.conf

interface=tun0
server=/MYDOMAIN.com/10.8.0.1
server=/mail.MYDOMAIN.com/10.8.0.1
listen-address=127.0.0.1,10.8.0.1
bind-interfaces
no-dhcp-interface=tun0

/etc/openvpn/server.conf:

push "dhcp-option DNS 10.8.0.1"

/etc/resolv.conf

domain MYDOMAIN.com
search MYDOMAIN.com
nameserver 127.0.0.1
nameserver 10.8.0.1
nameserver PUBLIC IP OF NS
nameserver PUBLIC IP OF NS

/etc/hosts

127.0.0.1     localhost localhost.localdomain
<PUBLICIP>     MYDOMAIN.com MYDOMAIN
10.8.0.1 MYDOMAIN.com mail.MYDOMAIN.com MYDOMAIN

From the Windows client, while connected to VPN:

nslookup mail.MYDOMAIN.com
Server:  UnKnown
Address:  10.8.0.1
*** UnKnown can't find mail.MYDOMAIN.com: No response from server

nslookup google.com
Server:  UnKnown
Address:  10.8.0.1
*** UnKnown can't find google.com: No response from server

from the server:

root@MYDOMAIN:/etc/apache2# nslookup mail.MYDOMAIN.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Name:   mail.MYDOMAIN.com
Address: 10.8.0.1


root@MYDOMAIN:/etc/apache2# nslookup google.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   google.com
Address: 74.125.225.16
Name:   google.com
Address: 74.125.225.17
Name:   google.com
Address: 74.125.225.18
Name:   google.com
Address: 74.125.225.19
Name:   google.com
Address: 74.125.225.20

From the Windows client, if I ping mail.MYDOMAIN.com, I get the public IP of the machine. If I change my c:\windows\system32\drivers\etc\hosts file to add:
10.8.0.1 mail.MYDOMAIN.com, everythign works. However, I'd like to get it to work without having to modify my hosts file.

Mimiko

Verify iptables rules on server.

janjust

what happens if you run

host  mail.MYDOMAIN.com 10.8.0.1

on the server?

also, try adding

register-dns

to the client config to make sure that the windows client picks up the new DNS server.

john_es

from the server, if I run:

 host mail.mydomain.com 10.8.0.1

I get:

Using domain server:
Name: 10.8.0.1
Address: 10.8.0.1#53
Aliases:

mail.mydomain.com has address 10.8.0.1

I have:

register-dns

in my client config file already.

Regarding iptables rules, what do I need to have, or what should I be looking for?

Mimiko

show the result of "iptables -L -n" and "iptables -L -n -t nat"