Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Finally i got OpenVPN up running, but now i really miss accessing all my webservices (apache, ftp, ssh etc.) through the VPN server. Is there a simple way to route all traffic from my wlan1 device to tap0?

server.conf:

port 1193
proto tcp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server 10.8.0.0 255.255.255.0
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
script-security 2

I was actually hoping that this forward would solve the problem but this was not the case:

/sbin/iptables -t nat -A POSTROUTING -o wlan1 -j MASQUERADE
/sbin/iptables -A FORWARD -i wlan -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

Setup:

This is basically my setup: DSL router -> Wireless router -> Ubuntu server.

On Ubuntu server i have hosted apache, ssh, and other server applications and services. When a client access my server by VPN, i would like to access all these services.

share|improve this question
    
You need to provide more detail on your setup. What's the client and the server, what are you trying to access and from where? Is all traffic going via the VPN server or only certain subnets? –  mgorven Feb 12 '13 at 17:36
    
@mgorven, the only purpose for the VPN is to access the webservices when im at my university. I would like to access my network the same way as when im home on the WLAN. My question has been edited, i hope i have supplied with enough info. –  JavaCake Feb 12 '13 at 17:57

1 Answer 1

up vote 1 down vote accepted

You still haven't provided much detail, so I'm going to guess that your setup is as follows. You usually access services on your server by its public IP (or a hostname which resolves to it), e.g. http://1.2.3.4/. When you start the VPN, OpenVPN connects to that same public IP 1.2.3.4, and while the VPN is up you access services using the server's private VPN IP, e.g. http://10.8.0.1/. You want to be able to use the public IP regardless of whether the VPN is up or not.

The best solution is to use a separate IP for the OpenVPN server because it greatly simplifies the routing. I'm assuming you don't have this option however.

The problem is that even when you're routing all traffic over the VPN, traffic to the VPN server's public IP must be routed out the default gateway in order for the encrypted VPN packets to actually get there. The routing table looks something like this:

192.168.0.0/24 dev eth0
1.2.3.4/32 via 192.168.0.1
10.8.0.1/32 dev tun0
default via 10.8.0.1

Since the other services you're trying to access use the same IP as the VPN server they also get routed directly out the default gateway. The only way around this is to use port-based routing, which is setup like this:

  1. Create a new routing table (only needs to be done once):

    echo 1 vpn >> /etc/iproute2/rt_table
    
  2. Route everything using this new table via the VPN:

    ip route add default via 10.8.0.1 table vpn
    
  3. Tell the kernel to use this new table for all packets with a specific firewall mark:

    ip rule add fwmark 0x01 lookup vpn
    
  4. Setup firewall rules to mark the packets you want to route via the VPN:

    iptables -t mangle -A OUTPUT -p tcp -j MARK --set-mark 0x01
    iptables -t mangle -A OUTPUT -p udp ! --dport 1193 -j MARK --set-mark 0x01
    

You'll probably want to set this up in an up script on the client, and tear it down in a down script.

share|improve this answer
    
you mention in the end that i need a up and down script on the client. But is step 1-4 performed on the server? –  JavaCake Feb 12 '13 at 18:33
    
@JavaCake No, all on the client. It's about how the client routes those packets. –  mgorven Feb 12 '13 at 18:34
    
i wonder if these modifications are possible on OS X. –  JavaCake Feb 12 '13 at 18:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.