Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an OpenVPN server and a client, and I want to use this tunnel to access not only 10.0.8.0/24 but the whole internet. So far, pinging the server from the client through the tun0 interface works, and vice versa.

However, pinging www.google.com from the client through tun0 doesn’t work (all packets are lost).

I figured that I should configure the server so that any packet coming from tun0 in destination of the internet be forwarded, so I came up with this iptables config line:

interface_connecting_to_the_internet='eth0'
interface_openvpn='tun0'
internet_ip_address=`ifconfig "$interface_connecting_to_the_internet" | sed -n s'/.*inet \([0-9.]*\).*/\1/p'`

iptables -t nat -A POSTROUTING -o "${interface_connecting_to_the_internet}" -j SNAT --to-source "${internet_ip_address}"
echo '1' > /proc/sys/net/ipv4/ip_forward

Yet, this doesn’t work, the packets are still lost and I am wondering what could possibly be wrong with my setup.


Some details:

ip route gives on the server:

default via 176.31.127.254 dev eth0  metric 3 
10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
127.0.0.0/8 via 127.0.0.1 dev lo 
176.31.127.0/24 dev eth0  proto kernel  scope link  src 176.31.127.109 

ip route gives on the client:

default via 192.168.1.1 dev wlan0  proto static 
10.8.0.1 via 10.8.0.5 dev tun0 
10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6 
127.0.0.0/8 via 127.0.0.1 dev lo  scope link 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.109 

  • client uses wifi adapter wlan0 and TUN adapter tun0.
  • server uses ethernet adapter eth0 and TUN adapter tun0.
  • the VPN spans on 10.0.8.0/24

  • both client and linux are using Linux 3.6.1.

share|improve this question
    
It probably would be helpful if you could elaborate on the OS used on the client and the routes defined on both the server and the client (the output of ‘ip route’ should do in the case of Linux). –  Claudius Nov 3 '12 at 21:55
    
@Claudius here you go! –  qdii Nov 3 '12 at 22:03
    
I assume that you have tried turning off iptables to eliminate that as the cause? –  Julian Knight Nov 3 '12 at 22:04
    
@JulianKnight I normally don’t use iptables, I just added the rule to see if it would help. So my first configuration did not use iptables. –  qdii Nov 3 '12 at 22:08
    
I take it you did not enable the push "redirect-gateway def1" option on the OpenVPN server? As of now, the routes on the client direct it to use 192.168.1.1 as the default gateway. To change that, you would have to add a specific route to your server via the current default gateway, then delete the default route and set a new one via your server (or, alternatively, use the option mentioned above). –  Claudius Nov 3 '12 at 22:08
show 6 more comments

1 Answer

up vote 1 down vote accepted

To sum up the discussion:

In order to reach a specific host A through a VPN from client C to server S, one has to:

  • enable ip forwarding on S (sysctl -w net.ipv4.ip_forward=1)
  • enable either masquerading or snat via iptables on S: iptables -t nat -A POSTROUTING -o ext_if -j MASQUERADE or iptables -t nat -A POSTROUTING -o ext_if-j SNAT --to-source ext_ip with the obvious meaning of ext_if and ext_ip.
  • set up appropriate routing on C, either (S denotes S’ IP address in the VPN):
    • by setting an explicit route to A via S: ip route add A via S dev vpn_if
    • by setting a default route via S: ip route add default via S dev vpn_if, where one also has to set an appropriate route to S: ip route add S via previous_gateway dev prev_if.
    • by using the push "redirect-gateway def1" on the server, in which case OpenVPN will set up routes to 0.0.0.0/1 and 128.0.0.0/1 on C via S, which are more specific than the default route and can easily be removed when the tunnel is stopped.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.