OpenVPN tun0 routing on server

Question

I have an OpenVPN tun0 10.8.0.0 255.255.255.0

There is an interface on the server eth1 for 192.168.0.0 255.255.255.0

I would like to route the OpenVPN connections to access the 192.168.0.0 network.

I can connect to the VPN from my client, I get an ip of 10.8.0.6 but on the server it will not route the traffic from tun0 to eth1. When I do a tracerout on the client for 192.168.0.1 it shows going out towards 10.8.0.1 but stops right there.

If I try to ping 192.168.0.1 on the server from tun0 I get no response. ping 192.168.0.1 -I tun0

Anyone can please help me what do I need to add on the server to get the routing and the NAT working?

Thank you!

Answer 1

You need to enable IP forwarding, then specify where you want forwarding to occur

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -i tun0 -s 10.8.0.0/24 -j MASQUERADE

See this answer for complete details and instructions on how to make this permanent / on boot:

How to forward packets between two interfaces?

This will allow devices inside 10.8.0.0/24 that already know (or assume) that 192.168.0.0/24 is behind 10.8.0.1 to reach any device in 192.168.0.0/24 via a Network Address Translation (NAT) of 192.168.0.1. Ergo, devices in 192.168.0.0/24 will think 192.168.0.1 is pinging them when in reality the real source is further back.

To make the other direction work, i.e. ping from 192.168.0.2 to 10.8.0.6, you need to do something completely different. Your devices or your router in in 192.168.0.0/24 must know that 10.8.0.0/24 is behind 192.168.0.1. You'd then use similar iptables rules to allow such routing on your bridge machine. Note that NAT isn't specified here.

# Run on each device in 192.168.0.0/24, or set up a static route on your router of the same:
route add -net 10.8.0.0 netmask 255.255.255.0 gw 192.168.0.1

# Run on your bridge machine:
iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth1 -j ACCEPT