Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The problem is similar to this scenario:
iptables rule still take effect after deleted

Scenario:
There are several clients(C1~C10) providing some services, such as SSH,HTTP.....
The clients are actually a personal computer behind NAT.
Their IP might be 192.168.0.x

For easily access these machines through internet, I built a OpenVPN server(S1).
All the C1~C10 connect to S1 with VPN address 10.8.0.x

If A user(U1) wanna access C1 SSH through internet, he can connect to S1 with port "55555", and S1 port forward 55555 to 10.8.0.6:22

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 55555 -j DNAT --to-destination 10.8.0.6:22

It works well until I mark the following in the openvpn server.conf:
I marked this because I think this will make all connection go through S1

;push "redirect-gateway"


      |-------(NAT)--------|  
(C1)--|                  (INTERNET)----(U1)  
      |-----(VPN)----(S1)--|  

The C1~C10 have their own path to access internet resource through NAT . The server loading would be heavy if all C1~C10 connection go through S1
(for example, C1 is sending data to C2, or C1 is downloading data from a FTP site).

Is there a way to solve this quandary?

Updated1:
(deleted)
Updated2: Well,I've solve this problem, It's quite easy http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html

share|improve this question
add comment

1 Answer

That's right, according to the OpenVPN documentation, if you set the option push "redirect-gateway" you are going to make all the traffic go through the OpenVPN Server.

It would be very helpful to see your server's OpenVPN configuration to indetify the problem, but I'm pretty sure it doesn't have anything to do with the iptables configuration.

Taking a wild guess I would say that you are not pushing your internal network configuration to the clients. That is done by writing on your servers conf something like this:

push "route 10.8.0.0 255.255.255.0 10.8.0.1"

Hope it helps.

share|improve this answer
    
Thank you,Gonzalo Alvarez. I've post current status on Updated1. Would you mind helping me again? –  Smith.Lai Sep 28 '12 at 11:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.