Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Debian 6 as my server, I have configured OpenVPN server there, and clients are connecting successfully using tap mode. This server is available from the internet, but It's also connected to internal network.

Local LAN: 192.168.3.0/24 - eth0 on OpenVPN server
OpenVPN clients: 192.168.199.0/24 - tap0 on OpenVPN server

It would be great if someone could give mi steps I have to follow to allow clients who connect to OpenVPN server to see and be able to connect to each machine within LAN where OpenVPN server is located (192.168.3.0/24 network).
It would be perfect if you could tell me how to setup this routing automatically after client connects.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you really need a TAP-style connection, you would need to specify the server-bridge option without further parameters - this would enable bridging mode and OpenVPN pass on DHCP requests (DHCP proxy mode). You also would need to bridge your tun interface with whatever your LAN interface is using brctl:

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 tun0
ifconfig br0 inet 192.168.3.99 netmask 255.255.255.0

see the server-bridge option description in the OpenVPN documentation for details.

But honestly, you should rather route than bridge whenever possible - it allows for better debugging and less unnecessary network noise (broadcasts) transmitted through your VPN.

For this case, a config file containing the push "route 192.168.3.0 255.255.255.0" on the server and the accompanying client-style config file (specifying the client option) would do. Example:

local <your public IP address>
port <your OpenVPN port>
proto udp
dev tun0
# reduce MTU if necessary
# tun-mtu 1400

# place your cert/key/DH paths here
ca keys/ca.crt
cert keys/server.crt
key keys/private/server.key
dh keys/dhparm.pem

# OpenVPN client network
server 192.168.99.0 255.255.255.0

# push client route
push "route 192.168.3.0 255.255.255.0"

keepalive 10 60

status /var/log/openvpn-status.log

daemon

# logging options
verb 4
mute 20

See the documentation for details on option parameters.

share|improve this answer
    
In addition to this, the OP will need to set up IP forwarding on the OpenVPN server. The default gateway on the LAN will also need to know how to route to the OpenVPN network range. There may also be iptables rules (e.g., permit FORWARD), but there needs to be more information on how your network is set up. –  cjc Jul 16 '12 at 14:52
    
@cjc I have more problems with iptables than openvpn at the moment - what details do you have to know? –  Wojtek Jul 16 '12 at 15:13
    
@Wojtek if you have any specific issues, post your ruleset and describe your problem in a new question –  the-wabbit Jul 16 '12 at 17:49
    
@cjc as this is an OpenVPN-centered question, I tried to keep most of what is not OpenVPN-related out of the answer. People not knowing how to configure OpenVPN are not necessarily ignorant of routing or netfilter rules. –  the-wabbit Jul 16 '12 at 17:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.