Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My setup is like this:

192.168.1.0/24 - server lan 192.168.3.0/24 - vpn subnet

192.168.1.11 - vpn server 192.168.1.12 - apache server

openvpn server config

local 192.168.1.11
port port_number
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/vpnserver.crt
key /etc/openvpn/keys/vpnserver.key
dh /etc/openvpn/keys/dh.pem
tls-auth /etc/openvpn/keys/ta.key 0
server 192.168.3.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
tcp-nodelay
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20
client-to-client
username-as-common-name
client-cert-not-required
key-method 2
tls-server
max-clients 15
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/auth/auth-ldap.conf"

openvpn client config

client
remote [public_ip_of_192.168.1.11] port_number
nobind
resolv-retry infinite
proto tcp
dev tun
ca filename.crt
tls-auth filename.key 1
auth-user-pass
cipher AES-128-CBC
ns-cert-type server
persist-key
persist-tun
fast-io
pull
comp-lzo
route-method exe
route-delay 2

I connect to the vpn from a remote location perfectly; subnet 192.168.1.0/24 is reachable.
But, when I access apache server on 192.168.1.12, the apache log says that the request is coming from my public IP (the client's public IP).

Is it possible that apache sees the vpn IPs (192.168.3) and not each client's public one ?

Any help is appreciated !
Thanks

share|improve this question
    
By 'public IP of 192.168.1.11' are you saying the machine is multi-homed, or are you connecting through a firewall with a port forward? –  JustinP Jan 17 '12 at 11:30
    
Windows or Linux? If Windows, the OpenVPN client needs admin privs to be able to set the routes over the VPN interface. –  cjc Jan 17 '12 at 11:59
    
@cjc I already said "subnet 192.168.1.0/24 is reachable." –  Stefanos Kalantzis Jan 17 '12 at 12:27
    
@JustinP VPN is behind firewall and is being port forwarded. –  Stefanos Kalantzis Jan 17 '12 at 12:28
add comment

1 Answer

OK, then in my limited experience this should be working and I cannot see how you would have the external IP address appearing in the web server logs. It might be worth making absolutely sure that your TEST is working correctly. Is there any possibility that your webserver is also available via port forward through the firewall, and that you're accidentally accessing it directly - make sure you've explicitly put 192.168.1.12 IP into the browser URL for instance.

Assuming that looks OK I have found using tcpdump on the openvpn server to be a good way to watch the packets go in and out, this would confirm whether packets are leaving the openvpn server bound for the apache server with the incorrect IP address rather than somehow going there direct from the firewall.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.