I seem to be having the opposite problem of most people who set up OpenVPN: I can't seem to limit VPN clients to just the VPN subnet. Instead, once a client establishes a connection, they're able to access any IP address on my OpenVPN server's LAN, regardless of subnet.
I do not want this behavior.
I'm using a Linksys WRT54GL router running Build 54 of TomatoUSB (NoUSB VPN edition). I configured OpenVPN via the 'VPN Tunneling' option in the Tomato GUI; here's a dump of the config.ovpn that is used when the service is started:
daemon server 10.8.0.0 255.255.255.0 proto udp port 1194 dev tun22 comp-lzo adaptive keepalive 15 60 verb 3 push "dhcp-option DNS 192.168.1.1" push "redirect-gateway def1" ca ca.crt dh dh.pem cert server.crt key server.key status-version 2 status status
I'm testing with OpenVPN 2.1.4 on a laptop running Windows 7 Home Premium 64-bit. Once the client has connected, I use whatsmyip.org to verify that I am masquerading as the server's IP address when browsing. Everything works as it should. The client configuration looks like this:
client dev tun proto udp resolv-retry infinite verb 3 nobind comp-lzo persist-key persist-tun remote REDACTED ca ca.crt cert client.crt key client.key redirect-gateway
As a client, I can ping 10.8.0.1 successfully but I can also ping any address in the 192.168.1.0 subnet. I don't want my VPN clients to have this capability; I'd rather the connection were just a tunnel and for clients to be contained within the 10.8.0.0 subnet.
Under the Advanced tab of the 'VPN Tunneling' page, I have made sure that 'Push LAN to clients' is NOT checked. The server config does not include the
push "route 192.168.1.0 255.255.255.0" line that normally pushes the LAN to clients. And yet, as a VPN client, I can ping and access any IP address in the server's LAN.
I am certain I am doing something wrong, but I need some guidance in troubleshooting this problem.