This looks like a trivial question, but I couldn't find the answer yet.
In my LAN (blue in the picture) I have a NAS and a Raspberry Pi, among other machines. I installed an OpenVPN server in the Raspberry Pi. I want the OpenVPN client to be able to access the NAS, meaning FTP, HTTP, etc. The client must not be able to access any machine other than the Raspberry and the NAS itself.
In this picture you have my networks topology:
I can connect OpenVPN client to its server. I know I have a subnet conflict but I cannot change the subnets.
My server configuration:
port 1194 proto udp dev tun ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/myserver.crt key /etc/openvpn/easy-rsa/keys/myserver.key dh /etc/openvpn/easy-rsa/keys/dh1024.pem server 10.8.0.0 255.255.255.0 #push "route 192.168.1.0 255.255.255.0" ifconfig-pool-persist /etc/openvpn/easy-rsa/ipp.txt keepalive 10 120 cipher AES-128-CBC persist-key persist-tun status /var/log/openvpn-status.log #log /var/log/openvpn.log log-append /var/log/openvpn.log verb 3
My client configuration file:
client remote x.y.z.t 1194 proto udp dev tun ca /etc/openvpnclient/ca.crt cert /etc/openvpnclient/client.crt key /etc/openvpnclient/client.key cipher AES-128-CBC #route-method exe #route-delay 3 #route 10.8.0.0 255.255.255.0 ###route-nopull route 192.168.1.20 255.255.255.255 resolv-retry infinite nobind persist-key persist-tun mute 20 verb 3
I can connect using the Windows client, but I cannot ping or access anyway the NAS. I am sure I am still missing something, but couldn't figure out how I can route the traffic. I have read many topics on the subject, but still no luck.
I should be able to add a routing rule in the router that is over the OpenVPN server network, if needed.
Update 18/11/2019 @17.31 CET
I have two main requirements:
- I need the client to reach the NAS, but not the other machines on the LAN;
- I need the client to be able to connect even when its subnet conflicts with the NAS subnet (i.e. 192.168.1.0/24).
Tom Yan and this article helped me getting a solution to first issue. I believe second issue is still uncovered.
Solution for issue #1:
In server configuration I needed to add (uncomment) this line, to ensure routing requests from the OpenVPN client to the NAS:
push "route 192.168.1.0 255.255.255.0"
To enable routing from the NAS back to the OpenVPN client I added this routing rule in the NAS:
adding this line in that (empty) configuration file
10.8.0.0/24 via 192.168.1.88
service network restart ensured the static route to be applied.
After that, I restricted traffic in the Raspberry Pi through iptables. I actually made it permanent installing
iptables-persistent and following this guide.
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 192.168.1.20 -j ACCEPT