Route all traffic through the tunnel (again)
Posted: Thu Jan 02, 2014 7:32 pm
Hi!
I read all the manual of OpenVPN, then tons and tons of guides, how-to's, troubleshootings and forum posts in two languages. Google will ban me soon. I am trying to make it work already two weeks. And I almost ready to give up.
Environment:
Server with fresh installed Debian Wheezy and OpenVPN.
Server is behind a router.
Server has IP 192.168.2.2 in LAN 192.168.2.0/255.255.255.0.
Router has WAN with real "white" IP and a domain name.
Router has internal LAN IP 192.168.2.1 and works as a Gateway and NAT for all LAN.
Router works as a DHCP server for internal LAN as well.
All computers in the LAN are connected through this router one way or another.
Port 5000 on the router is open outside and all requests are translated to the Server 162.168.2.2:1149
Goals:
1. To have access to the LAN resources from outside.
2. To have protected access to the Internet via encrypted tunnel from public (potentially unsafe) places.
Anyway, if a tunnel is up, all traffic must go through it.
First I wanted to make a bridge configuration, but Android devices do not suppot TAP.
Clients:
1. Android.
2. Linux.
3. Windows.
Server configuration:
I do not remove some commented lines to show I already tried these options.
Client configuration:
Firewall on server:
I tried "OpenVPN Connect" and "OpenVPN for Android" applications with similar results.
Connection is established and a client gets IP 10.20.30.6. Everything fine.
But:
1. If I disable two options:
I've got following results
2. If I enable option 'route'
results:
So I have access to the LAN, but other traffic still goes outside of the tunnel.
3. If I make it vice versa
results:
Looks like I do not understand how this feature works.
4. Enable both
predictable results:
Can anybody suggest what should I do to route all traffic to the tunnel?
Thanks in advance!
I read all the manual of OpenVPN, then tons and tons of guides, how-to's, troubleshootings and forum posts in two languages. Google will ban me soon. I am trying to make it work already two weeks. And I almost ready to give up.
Environment:
Server with fresh installed Debian Wheezy and OpenVPN.
Server is behind a router.
Server has IP 192.168.2.2 in LAN 192.168.2.0/255.255.255.0.
Router has WAN with real "white" IP and a domain name.
Router has internal LAN IP 192.168.2.1 and works as a Gateway and NAT for all LAN.
Router works as a DHCP server for internal LAN as well.
All computers in the LAN are connected through this router one way or another.
Port 5000 on the router is open outside and all requests are translated to the Server 162.168.2.2:1149
Goals:
1. To have access to the LAN resources from outside.
2. To have protected access to the Internet via encrypted tunnel from public (potentially unsafe) places.
Anyway, if a tunnel is up, all traffic must go through it.
First I wanted to make a bridge configuration, but Android devices do not suppot TAP.
Clients:
1. Android.
2. Linux.
3. Windows.
Server configuration:
Code: Select all
server 10.20.30.0 255.255.255.0
proto udp
dev tun
port 1194
tls-auth /etc/openvpn/keys/ta.key 0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/dh1024.pem
#push "redirect-gateway local def1"
push "redirect-gateway def1"
#push "redirect-gateway"
#push "route-gateway 10.20.30.1"
#push "route 10.20.30.0 255.255.255.0"
#push "route 0.0.0.0 0.0.0.0"
#push "route 192.168.2.0 255.255.255.0"
duplicate-cn
verb 3
user nobody
group nogroup
persist-key
persist-tun
comp-lzo
keepalive 10 120
ping-timer-rem
status /var/log/openvpn-status.log
Client configuration:
Code: Select all
float
client
#tls-client
#pull
remote my.host.com
port 5000
nobind
dev tun
proto udp
#redirect-gateway def1
resolv-retry infinite
persist-key
persist-tun
user nobody
group nogroup
comp-lzo
ns-cert-type server
ca /sdcard/openvpn/ca.crt
cert /sdcard/openvpn/user.crt
key /sdcard/openvpn/user.key
tls-auth /sdcard/openvpn/ta.key 1
Code: Select all
iptables -t nat -F
iptables -t filter -F
iptables -t mangle -F
iptables -I INPUT -j ACCEPT
iptables -I FORWARD -j ACCEPT
iptables -I OUTPUT -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 10.20.30.0/24 -j MASQUERADE
Code: Select all
# cat /proc/sys/net/ipv4/ip_forward
1
Connection is established and a client gets IP 10.20.30.6. Everything fine.
But:
1. If I disable two options:
Code: Select all
#push "redirect-gateway def1" (with flag 'local' or without - does not make any change)
#push "route 192.168.2.0 255.255.255.0"
Code: Select all
ping 10.20.30.1 - OK
ping 192.168.2.1 - FAIL
ping 192.168.2.2 - FAIL
ping google.com - OK
whatismyip.com - IP of Client's provider - means FAIL (traffic goes outside of the tunnel)
Code: Select all
#push "redirect-gateway def1"
push "route 192.168.2.0 255.255.255.0"
Code: Select all
ping 10.20.30.1 - OK
ping 192.168.2.1 - OK
ping 192.168.2.2 - OK
ping google.com - OK
whatismyip.com - IP of Client's provider - means FAIL
3. If I make it vice versa
Code: Select all
push "redirect-gateway def1"
#push "route 192.168.2.0 255.255.255.0"
Code: Select all
ping 10.20.30.1 - FAIL
ping 192.168.2.1 - FAIL
ping 192.168.2.2 - FAIL
ping google.com - FAIL
whatismyip.com - FAIL (no connection at all)
4. Enable both
Code: Select all
push "redirect-gateway def1"
push "route 192.168.2.0 255.255.255.0"
Code: Select all
ping 10.20.30.1 - FAIL
ping 192.168.2.1 - FAIL
ping 192.168.2.2 - FAIL
ping google.com - FAIL
whatismyip.com - FAIL (no connection at all)
Thanks in advance!