Lans behind OpenVPN

krzee

I made a document to help people understand everything they need to know about setting up a routed VPN where there are LANs behind OpenVPN.
https://community.openvpn.net/openvpn/wiki/RoutedLans

YOU MUST COMPLETELY READ THIS TO UNDERSTAND IT.

Also, dont expect it to walk you through your exact configuration, it exists to teach you about the different options you may need, not to hold your hand.

With that said, this is the place to discuss it.

KBerger

Well thanks a LOT for this clarification. Just as usual, things become more clear when repeated twice: first time in the official HOWTO and second time here.

Regards,
Kostya

DCh

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

DonJuane

Thank you for this illustration! It helps. I have one more request. Can you tell me how to configure this same illustrated setup with a slightly major alteration?

I wish to have the same ability to communicate from LAN to LAN to LAN in your single server and two client setup example here, however, I wish for all traffic from all LANs to be routed out only over the server gateway from a routed and not bridged network perspective. Also would like the DNS server used by the server gateway to serve all client stations in addition to the gateway. This will be for a dd-wrt setup if that is important to the solution.

Thanks in advance.

krzee

DonJuane wroteThank you for this illustration! It helps. I have one more request. Can you tell me how to configure this same illustrated setup with a slightly major alteration?

I wish to have the same ability to communicate from LAN to LAN to LAN in your single server and two client setup example here, however, I wish for all traffic from all LANs to be routed out only over the server gateway from a routed and not bridged network perspective. Also would like the DNS server used by the server gateway to serve all client stations in addition to the gateway. This will be for a dd-wrt setup if that is important to the solution.

Thanks in advance.

you would first get the lan routing working with the above document. then you would start using redirect gateway def1 on the clients (and enable nat on the server for the vpn/lan subnets). then when your clients route over the vpn, you would setup your lans to route using those clients for their default gateway (which is already normal since you said it would run on the routers).
The above document is only for routing to the lans, but the rest is not too hard. I have been meaning to make a little writeup on routing internet over vpn, but i havnt gotten around to it

zothen

Hello krzee and all,

I found your article because I ran into the "bad source address from client" in my Windows OpenVPN server log. In fact, I read pretty much every web page Google could find. But still I can't find an answer to my question.

All discussion about this error seem to assume the client has some static LAN IP that can then be configured on the server with iroute, etc. But one of the biggest use cases is for mobile when connecting with public or not-fully-trusted WIFI hotspots. In this case the client LAN IP Addresses will be random and so all this discussion of setting up the client LAN's IP address as part of the server configuration goes out the window. E.g., 10.x.x.x in one location, 172.16.x.x in the next, etc.

I am sure I am missing something but I'll be a monkey's uncle if I can find it. Could you help?

Some more background, at this point I could care less about VPN access from anything other than the client itself. But in my OpenVPN Server log, I get the "bad source address from client [IP of a proxy server required by a connection from my client, or IP of my WIFI Hotspot gateway]".

I have tried various configurations but here is an example of one that has this problem:
server.ovpn:

port 1194
proto tcp
dev tun
ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\server.crt"
key "C:\\OpenVPN\\config\\server.key" # This file should be kept secret
dh "C:\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 192.168.69.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
duplicate-cn
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 5
topology subnet

client.ovpn:

client
dev tun
proto tcp
remote remote <my home ip> 443 #my home router NATs to 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
verb 3

My client routes look something like this upon connecting to the server:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.69.1 0.0.0.0 UG 0 0 0 tun0
<my home ip> 192.168.43.1 255.255.255.255 UGH 0 0 0 wlan0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wlan0
192.168.43.0 0.0.0.0 255.255.255.0 U 2 0 0 wlan0
192.168.69.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0

In this example, 192.168.43.0 255.255.255.0 happens to be the LAN subnet, but it could change as I go to the next hotspot.

Thanks,
Rob

zothen

I just saw one mistake in my above message:

"or IP of my WIFI Hotspot gateway"

should be

"or IP of the 4G wifi hotspot".

Also to make sure it is very clear, in all cases I am trying to route all internet traffic from the client to the server. In some cases (at work) I will allow some private subnet range to be routed to the local lan and not to the VPN. In all cases my VPN server is running on Windows. The clients will be Windows, Linux, and Android.

Various websites and documentation talk about the use of iptables to route all internet traffic through the VPN server, but I am very confused as I have routed all internet traffic through the VPN server in the past without the use of iptables. The first time I did it was to my own Windows VPN server set up in TAP bridged mode. More recently, I have been using a OpenVPN service provider and my client is set up in TUN mode. No iptables usage on the client in either case and I'm able to route all internet traffic through the OpenVPN server just fine.

konqstar

@ krzee

What could one do, if say, in your particular example "client1 with lan 10.10.1.0" has an IP in that LAN like 10.10.1.120 and that is allocated to a bridged interface, as this client1 is a hypervisor for 5 VMs that are also members of the 10.10.1.0 lan ?

In my case:

root@client1:/home# route -een
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface    MSS   Window irtt
0.0.0.0         WAN_GW     0.0.0.0         UG    0      0        0 eth0     0     0      0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0     0     0      0
10.8.0.5        0.0.0.0          255.255.255.255 UH    0      0        0 tun0     0     0      0
10.10.1.0       0.0.0.0         255.255.255.0   U     0      0        0 xenbr0   0     0      0
WAN            WAN_GW     255.255.255.224 UG    0      0        0 eth0     0     0      0
WAN             0.0.0.0         255.255.255.224 U     0      0        0 eth0     0     0      0

After following your example, I ended up with:

root@client1:/home# route -een
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface    MSS   Window irtt
0.0.0.0         WAN_GW     0.0.0.0         UG    0      0        0 eth0     0     0      0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0     0     0      0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0     0     0      0
10.10.1.0       10.8.0.5        255.255.255.0   UG    0      0        0 tun0     0     0      0
10.10.1.0       0.0.0.0         255.255.255.0   U     0      0        0 xenbr0   0     0      0
WAN             WAN_GW     255.255.255.224 UG    0      0        0 eth0     0     0      0
WAN             0.0.0.0         255.255.255.224 U     0      0        0 eth0     0     0      0

Which obviously made my virtual machines inaccessible...
I know there's a fix for this as I saw this setup before somehwere, but I was curios what would you suggest.

Many many thanks for your comprehensive tutorial.

Cheers.

yetanotherlogin

It isn't entirely clear to me whether or not this setup will help with what I am trying to do.

LAN client (cell phone/computer/etc) via wifi
                |
                v
Wifi AP Router:
wlan0 local area network
using iptables masquerading to route through eth0
eth0 connects to internet 
via openvpn client
                |
                v
openvpn server

I simply want to have masqueraded values travelling through eth0 to go out to the openvpn server. Is there a way to only have the openvpn client handle traffic on a single device? I am really confused about what I need to be doing. I have tried adding iroutes and using ccd, but I am thinking that since I don't intend to give networks on either side access to one another that the iroute/ccd solution isn't actually going to solve my particular problem.

On the openvpn server (as it is right now) I am seeing errors like:
MULTI: bad source address from client [192.168.42.11], packet dropped
which lead me to try out the iroute solution. Maybe I should just stop using masquerading? The clients connect and data is being sent all the way to the openvpn server, but DNS doesn't appear to be working. I cannot ping anything on the internet (eg google.com) from the LAN clients which is my only goal here.

krzee

this thread was for the document, not for helping with everybody's individual use case. I guess I am going to lock the thread.