I have setup a small server with a bridged openvpn setup. My goal is use my network services and Internet connection from every location with Internet access. Right now I am just able to use services in my own network via the vpn. I looked into the option of a redirected gateway to force all traffic through the vpn. As soon as I activate this option I am not able to access the Internet, but for example my private owncloud setup in my local network. It would be really helpful, if someone could give me some advice. Thanks in advance.
GOAL:
Route all traffic of my Ubuntu-Laptop through my vpn.
Being able to access both internal as external services.
What I have already tried:
Push the DNS-settings through the vpn
Running various iptable commands with no effect
Where I think the problem is:
Even if I have already tried to configure the nat via iptable settings, I was never sure if I did it correct.
Server configuration
server.conf:
server-bridge port 1194 proto tcp dev tap0 ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key dh /etc/openvpn/dh2048.pem # server-bridge br0_address netmask clientlowerlimit clientupperlimit server-bridge 192.168.0.100 255.255.255.0 192.168.0.101 192.168.0.120 # push "route subnet_identifier netmask router_address" push "route 192.168.0.0 255.255.255.0 192.168.0.1" # push "dhcp-option DNS router_address" push "dhcp-option DNS 192.168.0.1" client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 3 ifconfig-pool-persist ipp.txt dh dh2048.pem script-security 2 push "dhcp-option DNS 192.168.0.1" push "redirect-gateway def1" bridge script:
#!/bin/sh # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged, # for example tap="tap0 tap1 tap2". tap="tap0" # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth1" eth_ip="192.168.0.21" eth_netmask="255.255.255.0" eth_broadcast="192.168.0.255" eth_gateway="192.168.0.1" case "$1" in start) for t in $tap; do openvpn --mktun --dev $t done brctl addbr $br brctl addif $br $eth for t in $tap; do brctl addif $br $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done sleep 10 ifconfig $eth 0.0.0.0 promisc up ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast route add default gw $eth_gateway ;; stop) ifconfig $br down brctl delbr $br for t in $tap; do openvpn --rmtun --dev $t done ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast route add default gw $eth_gateway ;; *) echo "Usage: bridge {start|stop}" exit 1 ;; esac exit 0 Client configuration
client.conf:
client dev tap0 proto tcp #I use port 80 because it is nerver blocked remote domain.org 80 persist-key persist-tun ca ca.crt cert test.crt key test.key remote-cert-tls server comp-lzo verb 3 script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf update-resolve-conf:
#!/bin/bash # # Parses DHCP options from openvpn to update resolv.conf # To use set as 'up' and 'down' script in your openvpn *.conf: # up /etc/openvpn/update-resolv-conf # down /etc/openvpn/update-resolv-conf # # Used snippets of resolvconf script by Thomas Hood and Chris Hanson. # Licensed under the GNU GPL. See /usr/share/common-licenses/GPL. # # Example envs set from openvpn: # foreign_option_1='dhcp-option DNS 8.8.8.8' foreign_option_2='dhcp-option DNS 192.168.0.1' # foreign_option_3='dhcp-option DOMAIN be.bnc.ch' # [ -x /sbin/resolvconf ] || exit 0 [ "$script_type" ] || exit 0 [ "$dev" ] || exit 0 split_into_parts() { part1="$1" part2="$2" part3="$3" } case "$script_type" in up) NMSRVRS="" SRCHS="" for optionvarname in ${!foreign_option_*} ; do option="${!optionvarname}" echo "$option" split_into_parts $option if [ "$part1" = "dhcp-option" ] ; then if [ "$part2" = "DNS" ] ; then NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3" elif [ "$part2" = "DOMAIN" ] ; then SRCHS="${SRCHS:+$SRCHS }$part3" fi fi done R="" [ "$SRCHS" ] && R="search $SRCHS " for NS in $NMSRVRS ; do R="${R}nameserver $NS " done echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn" ;; down) /sbin/resolvconf -d "${dev}.openvpn" ;; esac 2 Answers
I was able to partially solve the problem. I am using the using the ubuntu vpn network manager to connect to the server, so there is no client config anymore However the my server config changed to this:
server-bridge port 1194 proto tcp dev tap0 ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key dh /etc/openvpn/dh2048.pem # server-bridge br0_address netmask clientlowerlimit clientupperlimit server-bridge 192.168.0.100 255.255.255.0 192.168.0.101 192.168.0.120 # push "route subnet_identifier netmask router_address" push "route 192.168.0.1 255.255.255.0" # push "dhcp-option DNS router_address" push "dhcp-option DNS 192.168.0.1" push "redirect-gateway def1 bypass-dhcp" client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 3 ifconfig-pool-persist ipp.txt dh dh2048.pem script-security 2 After connecting to the server I was still not able to access the Internet via the vpn. To make it work I had to run following command on the client:
sudo route add default gw 192.168.0.1 The only task left to do is to find a way how to automatically run this command after stating the vpn connection. I would be thankful for any suggestions.
Try this for client config of the .ovpn file
client dev tun proto udp remote remote-ip 1194 resolv-retry infinite nobind persist-key persist-tun ca ca-cert.pem cert client-user-cert.pem key client-user-key.pem ns-cert-type server comp-lzo redirect-gateway def1 verb 3 auth-nocache auth-user-pass
