Tunnel Connections through VPN

jason1101

When a server is configured correctly and tunneling connections through the vpn server, should websites visited see the client ip address as the clients ip or the server ip? I have a client that is connecting through our server from overseas. When visiting whatismyip.com the site correctly shows our server address. When going to our site, the server log shows their originating ip address (Note: the client is connecting to our vpn from within another companies network -- computer 192.168.1.x. @ company ip x.y.z.55).

Is it possible that the other companies network is interfering with and therefore not establishing a correct connection?

Is the connection encrypted, but just shows the originating ip address because it is on our server?

I understand that openvpn is not a proxyserver, but using a proxyserver the client computer is able to connect to our website and their connection indicates the server ip. With all traffic being tunneled, shouldn't do the same when they are conncted via the vpn?

relevant info below.

server.conf
=======
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir clients
route 10.8.0.0 255.255.255.252
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log 5
status-version 2
log-append /var/log/openvpn/openvpn.log
verb 4

/etc/sysctl.conf
==========
net.ipv4.ip_forward=1

iptables
=====
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

maikcat

hi there,

>When going to our site, the server log shows their originating ip address

where exactly is "our site"?
is it in the same ip that openvpn server listens?

what exactly is "their originating" ip?
is the same ip that you also into openvpn server logs establishing the vpn connection?

tip: take a look to your client routing table.. 😉

Michael.

jason1101

where exactly is "our site"?
is it in the same ip that openvpn server listens?

yes. the server that hosts the web gui for our app also holds the openvpn server side which the clients connect to.

what exactly is "their originating" ip?
is the same ip that you also into openvpn server logs establishing the vpn connection?

Their originating ip is the openvpn client connecting to the internal wireless network at the company (company b) they are visiting with, ie company b's external ip address. When connected to the web gui on our server, our access log shows the connection from the external ip address of company b. With a proxy server test, when the opnvpn client computer connects to our site (vpn off) the access log shows the external ip address for our company.

The root of this is that I'm trying to make sure that when the openvpn client turns the vpn on, that their computer has in fact established an encrypted connection and their traffic is being tunneled through our server.

http://pastebin.com/WtgUmzHx -- this is the full server log after a restart

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 xx.xx.216.1 0.0.0.0 UG 100 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.252 UG 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
xx.xx.216.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

maikcat

>yes. the server that hosts the web gui for our app also holds the openvpn server side which the clients connect to.

thats why you see the clients original ip...

think about it,
when you connect to openvpn server ip (which is the SAME ip to web server too)
this traffic needs to pass through your internet router,NOT the vpn itself (chicken & egg problem),
thats why you see the clients static ip..

Michael

jason1101

Thanks. That makes some sense at the moment. I was expecting that the log would show their 10.8.0.x IP when they connected to our site. IE first it makes a connection to the VPN at our IP. It then get's reassigned 10.8.0.x and then that ip makes an internal connection to our the website which would show the log accessing from the 10.8.0.x IP. Why is that not the case?

If in your example the internet router you cited is the one on our company side, shouldn't it never do that with the VPN? It has already made the connection first from the client ip (via their router) to us. If it did jump external to jump back in going through the router here it would show our company IP at that point.