Help with final touches to routing
Posted: Mon Aug 22, 2011 8:38 am
Hi there,
I am having a problem with the final touches on my network setup. I am completely new to openvpn and not very familiar with networking concepts, but I am pretty competent with Linux.
My home network setup is this:
192.168.1.1 - DSL router - rubbish one from DSL provider
192.168.1.2 - NAS / server
192.168.1.X - lots of other devices.
The NAS is a QNAP running Debian, and is only 12W so it is permanently on to supply services and data to the rest of my network. I currently run a dnsmasq server on the NAS to supply ip addresses to everything on the network. The openvpn client also runs there.
I then have a ps3 which can be used to access UK TV catchup services. I use iptables to forward the ps3 connection to the openvpn network, which is working.
My problem is that the NAS is currently using the openvpn route by default and I do not want it to do this. When I try to use the noexec/route-up options in openvpn, I cannot get the ps3 to connect.
My configuration is as follows...
openvpn:
Here are some bits of my dnsmasq config:
As you can see, I supply the router as the gateway for 'normal' devices and the just connect to the internet through the router. For the PS3, I tell it to use the NAS as the gateway.
Once I connect the vpn tunnel, I run the following iptables commands to tunnel the PS3 connection through the vpn:
I must admit, I don't really understand all of the options in the iptables commands, I adapted another script and managed to add the -s option to limit the forwarding to the PS3 only.
So basically this much works fine. All machines are using the normal internet connection whilst the ps3 is using the vpn.
So now what I want to do is have the NAS set the tun0 device up without routing its own connection through it. When the openvpn client connects, it does the following:
I can disable this and copy this to a script for tuning myself. I run openvpn like this:
When running route I get this:
I thought that if I then remove the 128.0.0.0 lines from the routes.sh script it would work, but this then prevents the PS3 connecting so I'm a bit stuck now.
I am having a problem with the final touches on my network setup. I am completely new to openvpn and not very familiar with networking concepts, but I am pretty competent with Linux.
My home network setup is this:
192.168.1.1 - DSL router - rubbish one from DSL provider
192.168.1.2 - NAS / server
192.168.1.X - lots of other devices.
The NAS is a QNAP running Debian, and is only 12W so it is permanently on to supply services and data to the rest of my network. I currently run a dnsmasq server on the NAS to supply ip addresses to everything on the network. The openvpn client also runs there.
I then have a ps3 which can be used to access UK TV catchup services. I use iptables to forward the ps3 connection to the openvpn network, which is working.
My problem is that the NAS is currently using the openvpn route by default and I do not want it to do this. When I try to use the noexec/route-up options in openvpn, I cannot get the ps3 to connect.
My configuration is as follows...
openvpn:
Code: Select all
client
fast-io
dev tun
#dev tap
proto udp
nobind
remote shared69.vpnuk.net
route-method exe
route-delay 2
resolv-retry infinite
persist-key
persist-tun
auth-user-pass
ca vpnuk-ca.crt
tls-auth ta.key 1
comp-lzo
verb 3
Code: Select all
domain-needed
bogus-priv
server=/localnet/192.168.1.1
expand-hosts
dhcp-range=192.168.1.101,192.168.1.199,168h
dhcp-option=option:router,192.168.1.1
dhcp-option= tag:ovpn, option:router,192.168.1.2
# ps3
dhcp-mac=set:ovpn,A8:E3:EE:8D:44:A3
dhcp-host=A8:E3:EE:8D:44:A3,192.168.1.24
dhcp-host=XXX - lots of other devices I won't bore you with.
Once I connect the vpn tunnel, I run the following iptables commands to tunnel the PS3 connection through the vpn:
Code: Select all
#!/bin/sh
INTIF="eth0"
EXTIF="tun0"
EXTIP="`/sbin/ifconfig tun0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -s 192.168.1.24 -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
So basically this much works fine. All machines are using the normal internet connection whilst the ps3 is using the vpn.
So now what I want to do is have the NAS set the tun0 device up without routing its own connection through it. When the openvpn client connects, it does the following:
Code: Select all
route add -net 109.108.151.147 netmask 255.255.255.255 gw 192.168.1.1
route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.10.11.41
route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.10.11.41
route add -net 10.10.11.0 netmask 255.255.255.0 gw 10.10.11.41
Code: Select all
openvpn --script-security 2 system --route-noexec --route-up /root/vpnuk-openvpn/routes.sh --config udp.ovpnCode: Select all
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
109.108.151.147 router 255.255.255.255 UGH 0 0 0 eth0
10.10.11.41 * 255.255.255.255 UH 0 0 0 tun0
localnet * 255.255.255.0 U 0 0 0 eth0
10.10.11.0 10.10.11.41 255.255.255.0 UG 0 0 0 tun0
default 10.10.11.41 128.0.0.0 UG 0 0 0 tun0
128.0.0.0 10.10.11.41 128.0.0.0 UG 0 0 0 tun0
default router 0.0.0.0 UG 0 0 0 eth0