Change Routing rules for a client

[supermario18b]

Hi everyone,

I'm trying to change the routing rules only for a client. The other clients have total access to internet and to the lan. I'd like this client to be able only to connect with the server.
I used "push-reset" in the client configuration file to not use the default server routing rules and it worked. Maybe it worked...
The routing table shows:

Code: Select all

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1    0.0.0.0         UG    600    0        0   wlan0
192.168.1.0    0.0.0.0         255.255.255.0   U     600    0        0 wlan0
255.255.255.0   0.0.0.0         255.255.255.255 UH    0      0        0  tun0

The last destination (255.255.255.0) shouldn't be present. However the could be a second question

The server has the ip 10.3.0.1 and the client 10.3.0.6 (tun0). I'd like client only connect to the server.
I've tried with "iroute" and "push" surely I did it wrong

Could you please tell me what I have to add in my configuration/s file/s?


server.conf:

View Originalserver.conf

port 1194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.3.0 255.255.255.0
client-config-dir /etc/openvpn/client
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

/etc/openvpn/client/client1:

View Originalclient1

push-reset

Above I tried also with: push "route 10.3.0.1 255.255.255.255 10.3.0.1" and "iroute 10.3.0.1 255.255.255.255"


client.opvn:

View Originalclient.opvn

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote public ip and port
auth-nocache
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3

Thanks

P.S. The Openvpn server is 2.4.0 installed on debian stretch

[TinCanTech]

See --push-remove in The Manual v24x

push-remove

[supermario18b]

See --push-remove in The Manual v24x

push-remove

Hi TinCanTech, thanks for the reply, I just tried with "push-remove route" and it is much better:

Code: Select all

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1    0.0.0.0         UG    600    0        0   wlan0
10.3.0.0        0.0.0.0         255.255.255.0   U     0      0        0   tun0
192.168.1.0    0.0.0.0         255.255.255.0   U     600    0         0 wlan0

Now the whole 10.3.0.0/24 will be routed but I'd like only the 10.3.0.1/32 IP. A last suggestion to accomplish that?


EDIT: I tried with "push-remove route" and "push route 10.3.0.1 255.255.255.255 10.3.0.1". Now it is so:

Code: Select all

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1    0.0.0.0         UG    600    0        0 wlan0
10.3.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.3.0.1        10.3.0.1        255.255.255.255 UGH   0      0        0 tun0
192.168.1.0    0.0.0.0         255.255.255.0   U     600    0        0 wlan0

Now I "only" have to remove this line:

10.3.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0

Thanks for more info