0

I setup a OpenVPN server (VPN ip=10.8.0.1) on a Server with public ip. And I have a workstation(Ubuntu) in my laboratory with school ip that can access intranet resources of school.

I want my Android Phone and Windows PC can access the that resources. So I:

  • OpenVPN server config:

    dev tun
    topology subnet
    server 10.8.0.0 255.255.255.0
    client-config-dir /etc/openvpn/server/ccd
    push "route 10.8.0.0 255.255.255.0"
    push "route-gateway 10.8.0.3"

  • Connect my workstation to server and get a ip 10.8.0.3, its ccd config (equivalent to client config ) is:

    ifconfig-push 10.8.0.3 255.255.255.0

  • In workstation, used iptables and added some items:

    $ sudo iptables -t filter -S
    -P INPUT ACCEPT
    -P FORWARD ACCEPT
    -P OUTPUT ACCEPT
    $ sudo iptables -t nat -S
    -P PREROUTING ACCEPT
    -P INPUT ACCEPT
    -P OUTPUT ACCEPT
    -P POSTROUTING ACCEPT
    -A POSTROUTING -s 10.8.0.0/24 -o wlx0810752b55c9 -j MASQUERADE

  • The ccd config of my pc at home is:

    ifconfig-push 10.8.0.5 255.255.255.0
    push "route-gateway 10.8.0.3"
    push "redirect-gateway def1 bypass-dhcp"
    push "dhcp-option DNS 8.8.8.8"

  • Result1 The pc cannot connect to internet. The route table of that pc is:

    route print -4
    0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.21 35
    0.0.0.0 128.0.0.0 10.8.0.3 10.8.0.5 291
    128.0.0.0 128.0.0.0 10.8.0.3 10.8.0.5 291

the latter two item is what "redirect-gateway def1" added, without remove the original default gateway. I am curious that why def1 works to redirect traffic? Because the original default gateway is still there and with a better metric, thus no traffic would go through VPN.

  • Result 2 My Android Phone cannot too.

    $ busybox ip route show table all
    default via 10.183.93.203 dev ccmni0 table 1002
    default dev tun0 src 10.8.0.4
    10.8.0.0/24 dev tun0 table 1015
    10.8.0.0/24 dev tun0 src 10.8.0.4 ...

I made sure that the workstation didn't receive the traffic:

$ sudo tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
$

I have go through much topics about this with no working solution. So, anyone can help me, any suggest is appreciated!

  • do you have client to client enabled on the openvpn server config? – Timmy Browne Apr 2 '18 at 5:57
-1

In the ccd directory in the server the workstation file should contain iroute Try that please, I'm trying to do the same thing without using the access server and using a linux client as gateway as shown here https://www.youtube.com/watch?v=b7qr0laM8kA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.