Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So, I have the following question: Given a server with public (routable) ip's, let's say: x.y.z.1, x.y.z.2, x.y.z.3 - x.y.z.31, I want to configure OpenVPN as a proxy or masquerade server for some clients as follows: each client has a unique public static ip address: a.b.c.d. He will connect to the allowed server address: x.y.z.1 (he shall not be able to connect to any other public ip address of the server). Using this connection, he should be able to browse the internet having the public ip address to which he connected in the first place, say x.y.z.1. This setup is trivial using only Squid (attached for the ones who need it) but I must find a way to do this whole shebang using OpenVPN.

acl testuser1src src a.b.c.d # this is the client's public ip address

acl testuser1bindip myip x.y.z.1 # one of the server's public ip addresses

tcp_outgoing_address x.y.z.1 testuser1bindip

http_access allow testuser1src testuser1bindip # if the two conditions are fulfilled OK

Thanks in advance

share|improve this question
add comment

3 Answers

Where "1.1.1.1" is the client's OpenVPN-assigned address and, "9.9.9.9" is the public IP address to SNAT the client's traffic to/from:

iptables -t nat -A POSTROUTING -s 1.1.1.1 -j SNAT --to-source 9.9.9.9

That's doing what you want on a test box of mine here. Obviously, you'll need OpenVPN setup with client configuration files to dole out the same IP address to a given client when they connect, but it sounds like you've got that already.

If you don't already have an entry in your FORWARD chain to allow the traffic from the clients through you'll want to add a rule there, too. You could do something like this if you want to blindly forward traffic received on a tunnel interface bound for the Internet:

iptables -A FORWARD -i tun+ -o internet-interface -j ACCEPT

Finally, if you want to direct unsolicited inbound connection attempts for the clients' public IP addresses to the clients you'll want to do that on the PREROUTING chain in the nat table with something like:

iptables -t nat -I PREROUTING -d 9.9.9.9 -j DNAT --to-dest 1.1.1.1
share|improve this answer
add comment

You can use the ipp.txt file on openvpn server so it assigns only the IP you want to each client. On default, ipp.txt is maintained by openvpn server but you can change that so you maintain it using the following line in your server config file (openvpn will not update ipp.txt anymore):

ifconfig-pool-persist /path/to/ipp.txt 0 on the server config (just adding 0 at the end of the default line).

The file is in the form host,ip.

share|improve this answer
    
Thank you very much, that's exactly what I was looking for. And you say that if i do something like: client1, 10.8.0.2 client2, 10.8.0.3 in ipp.txt client1 and 2 will always be given these addresses? I'll try that and get back to you. Anyway, thanks alot :D –  R.C. Jul 19 '10 at 8:26
    
yes, each one on a different line and disabling openVPN from updating the file with the 0 in config file. –  laurent Jul 19 '10 at 13:02
add comment

Thanks for the quick reply, Evan. However, SNAT-ing and DNAT-ing are not the issue here. Let me get a real life example to show you exactly what I want:

We have two clients, each with a unique public IP: client1: 219.16.233.140 and client2: 143.12.155.19. The server has the ip addresses: 213.230.161.1 - 213.230.161.31. First of all, I want to assign each of the clients one (and only one!!!) public IP address from my server, IP address they will use to mask themselves on the internet.

client1(219.16.233.140) ---> 213.230.161.10 client2(143.12.155.19) ---> 213.230.161.11

We setup OpenVPN with the least configuration possible: a static key shared amongst all clients:

Server configuration file dev tun server 10.8.0.0 255.255.255.0 secret static.key Client1 configuration file remote 213.230.161.10 dev tun ifconfig 10.8.0.2 10.8.0.1 secret static.key Client2 configuration file remote 213.230.161.11 dev tun ifconfig 10.8.0.3 10.8.0.1 secret static.key

I can, of course, limit Client1 to connect only to 213.230.161.10 and Client2 to connect only to 213.230.161.11, but how do I prevent them from switching tunnel ip's? I mean, client1 can easily modify the .ovpn file so that it sais: ifconfig 10.8.0.3 10.8.0.1, thus interfering with client2. This will render the SNAT-DNAT rules useless. That's my dilemma, how do I link the client's public ip to the tunnel ip seen on the server side (to 219.16.233.140 only the 10.8.0.2 address can be used internally on the ovpn tun interface, and 219.16.233.140 can connect only to 213.230.161.10).

Thanks, R.C.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.