0

So there's an OpenVPN Server with multiple clients, which I successfully divided into multiple subnets.

  • 10.0.30.0/26 for generic clients which are only allowed to communicate with the OpenVPN Server itself.
  • 10.0.30.64/26 for privileged clients which are allowed to access the local network.

The OpenVPN server has only one physical interface [eno1] which is connected to the local network 10.0.10.0/24 (which then is connected to a router for internet access). Now everything seems to be set up correctly on OpenVPN side, as the clients are being assigned adresses from the correct pool and the correct route is pushed to the privileged clients.

The difficult part comes with forwarding IP traffic though ...

ip_forwarding is enabled:

# cat /proc/sys/net/ipv4/ip_forward
1

The interfaces are separated into different zones in firewalld:

# firewall-cmd --get-active-zones
home
  interfaces: eno1
trusted
  interfaces: tun0

I fiddled with tons of iptables-rules, but I simply can't get this to work. The one thing I'm totally unfamiliar with is firewalld...

When I deploy this rule the clients can access the local network, but through NAT. I need the services on the local network to be able to see the actual client IP from the 10.0.30.64/26 subnet.

firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o eno1 -j MASQUERADE

Of course this simple NAT attempt is not filtering for only the privileged source addresses, but imo it shows that the OpenVPN config itself is good and "only" the forwarding part is missing...

So the question is: How to configure IP forwarding from interface tun0 for source IPs 10.0.30.64/26 to interface eno1 for destination IPs 10.0.10.0/24?

Improve this question
3
  • Did you check what packets are seen on eno1 when you don't have NAT?
    – u1686_grawity
    May 2, 2020 at 18:47
  • That was actually a great question. I see a SYN packet going out from eno1, but there is no reply coming back, which results in a connection timeout after 4 retries. So I suppose the answer is, that the hosts on the local network need a route to the OpenVPN server for it's clients, as they are not handled by the default gateway. Am I right?
    – binary_jam
    May 2, 2020 at 21:33
  • Yes, that sounds about right.
    – u1686_grawity
    May 2, 2020 at 21:46

1 Answer 1

Reset to default
0

The forwarding is already configured – if it weren't, your "masquerade" rule wouldn't do anything. (The firewall can only alter those packets which are going through it anyway, but it cannot actually force the packets to be forwarded if they otherwise wouldn't be.)

The most likely problem here is that your LAN hosts don't know where to send replies back to the client. They have no routes for the 10.0.30.x subnets; they attempt send the replies through the default gateway; said gateway doesn't have apropriate routes either; the packets eventually go "outside" and end up discarded at your ISP.

(With NAT enabled, the LAN hosts think they're being contacted by another host in the local 10.0.10.0/24 subnet, which they do have a route for and can reply.)

To solve this problem, add a route 10.0.30.64/26 via 10.0.10.??? (with the OpenVPN server's IP address as the nexthop) either on the local LAN gateway and/or on each individual host. The latter could be done using a DHCP option.

Improve this answer
1
  • That did the trick. I went for adding a route to the default gateway. In my setup the traffic will be negligible compared to the available capacity. Plus it adds the benefit of not having to add the route to every single device. Thanks for your help!
    – binary_jam
    May 2, 2020 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .