Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Note: This is a repost from the OpenVPN forums

I have just set up an OpenVPN on my Linode VPS, and I have successfully connected my Android phone to it. Now, I want to use the "route all traffic" option on the client. I'm not sure how to set up the routes on the server side though, so I would greatly appreciate any help. I'm taking a class this summer at my local Community College, and they seem to think that an open WAN with web authentication is secure enough.

Here are my interface configurations:

eth0 Link encap:Ethernet HWaddr f2:3c:91:93:a8:c2
inet addr:173.255.235.246 Bcast:173.255.235.255 Mask:255.255.255.0 inet6 addr: 2600:3c03::f03c:91ff:fe93:a8c2/64 Scope:Global inet6 addr: fe80::f03c:91ff:fe93:a8c2/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:126144742 errors:0 dropped:0 overruns:0 frame:0 TX packets:315279 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2301671639 (2.3 GB) TX bytes:136422020 (136.4 MB) Interrupt:44

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:3971 errors:0 dropped:0 overruns:0 frame:0 TX packets:3971 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:753104 (753.1 KB) TX bytes:753104 (753.1 KB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

      inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
      UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:100 
      RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
share|improve this question

2 Answers 2

up vote 0 down vote accepted

Bear in mind that although openvpn will provide you a secure tunnel it won't stop access to your android device across the LAN, so you might want to be having a look at that too.

What is your network layout on the vpn server side of things? That will help get the ball rolling.

share|improve this answer
    
Thanks. I have edited the question with my current interfaces. I'm not as concerned about LAN accessibility as I am about sniffing and/or firesheep type attacks. I am running CyanogenMod 7.1 RC1 (which is based on Android 2.3.4, which is the latest version as of this writing), so I should be protected from most exploits that are in the wild. –  Sean W. Jun 28 '11 at 14:43
    
Ok so if your server is directly available on the internet and there are no other private subnets to route to I think all you should need to do is go to the VPN settings page on the openvpn admin interface and add 0.0.0.0/0 as a private subnet that the server would provide access to. –  Alex Berry Jun 28 '11 at 14:59
    
I don't have the admin interface installed, so I read the config file, /etc/openvpn/server.config, and added the line ;push "route 0.0.0.0 0.0.0.0" with no success. –  Sean W. Jun 28 '11 at 22:59
    
OK, well I've not played around with the config files before, our openvpn server is a virtual appliance and, as such, seems to be a little weird when trying to locate config files. Anyway, I'm not sure my original idea is necessary, openvpn's website has a small guide as to how to route all traffic through the VPN server: openvpn.net/index.php/open-source/documentation/… –  Alex Berry Jun 29 '11 at 10:56

You will need to have your VPN traffic run through NAT or masquerading, as well as configure the system for IP forwarding. By default, Linux will have IP forwarding disabled. Once that is enabled, you have to do something (NAT or MASQ) to convert the IP address from 10.8.0/24 to a publicly-routable address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.