Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up an openvpn server and client, with all client traffic being routed through the server. I am currently able to access the server through the client, but when I enable 'push "redirect-gateway def1"' on the server, the client loses all ability to connect to the internet, vpn or otherwise. In addition, it can no longer connect to the server, though lan connectivity is still fine. My server config file is:

local ***.***

port 1194

proto tcp

dev tun

ca ca.crt
cert server.crt
key server.key

dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway local def1"

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log

verb 3

and here's the client:

client

dev tun

proto tcp

remote ***.*** 1194

resolv-retry infinite

nobind

persist-key
persist-tun

ca ca.crt
cert laptop.crt
key laptop.key

ns-cert-type server

comp-lzo

verb 3

On the server, I enabled ip forwarding and enabled routing via iptables:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

but the client is still not able to connect to anything on the VPN or the internet.

share|improve this question
add comment

3 Answers 3

For reference, the relevant section of the HOWTO is here, though I suspect you've followed that.

The first thing I'd try is to remove the 'local', that is the command should be

push "redirect-gateway def1"

and not

push "redirect-gateway local def1"

The local flag only works if all of your clients are on the same subnet.

A couple of other things to be aware of are that DNS traffic is routed through the vpn so you won't be able to resolve addresses unless you've dealt with that. DHCP can also get forwarded though it doesn't look like that should happen in your case as you're using a routed not a bridged VPN, but might be worth checking anyway.

share|improve this answer
    
The "local" flag was there because I was testing on the same lan at the time. I'll repeat the test somewhere else today. I'll keep in mind to push dns info as well,thanks. –  correnos Aug 14 '10 at 3:06
add comment

If you are "pushing" a new gateway to the client, then you also need to push some routes, in particular the route to the subnet where that gateway resides. That will give you internet access through the VPN. If the network where the gateway resides is different from the one where the VPN server lives, then you also need additional routes so that the client can access these other networks. Plus, you may then want to also push DNS servers to the client, because otherwise the client cannot resolve the names of any of the targets on the network it is now connected to.

Here is an extract from our OpenVPN server config file:

# Push route to client to bind it to our local
# virtual endpoint.
#
push "route 10.180.0.1 255.255.255.255"

# Push any routes the client needs to get in
# to the local network.
#
push "route 10.171.0.0 255.255.0.0"
push "route 10.172.0.0 255.255.0.0"
push "route 10.173.0.0 255.255.0.0"
push "route 10.174.0.0 255.255.0.0"
push "route 10.175.0.0 255.255.0.0"
push "route 10.176.0.0 255.255.0.0"
push "route 10.177.0.0 255.255.0.0"
push "route 10.181.0.0 255.255.0.0"
push "route 10.182.0.0 255.255.0.0"
push "route 192.168.61.0 255.255.255.0"

# Push DHCP options to Windows clients.
#
push "dhcp-option DOMAIN our-internal-domain.com"
push "dhcp-option DNS 10.a.b.c"
push "dhcp-option WINS 10.b.c.d"

These are all internal networks, and we don't even push a new gateway (as most of our users connect from far away, they are better off accessing the internet through their default gateway and we are not control freaks).

share|improve this answer
    
The only important remote server is also hosting openvpn, so additional routes are not a problem. The main thing is browsing security, which is why I'm trying to have web traffic forwarded. –  correnos Aug 15 '10 at 1:22
add comment
up vote 0 down vote accepted

Actually, the problem was that NAT wasn't set up correctly. Fixed, and the vpn is working now.

share|improve this answer
add comment

protected by SvW Mar 13 at 11:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.