Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At first I thought this was a misconfigured IPTABLES but it is not. Note that this is not an issue with LAN web requests, only WAN.

I temporarily deactivated all iptables chains except logging of all inbound and outbound. iptables logs that incomming requests are coming in but no responses going out. I've tried my desired port 80 but also a handful of higher ports as well.

Once I shutdown the openvpn client, the webserver listening on port 80 (nginx) is able to serve web pages to all IPs external from my LAN.

I can't find any logs on the machine that gives a clear answer. nginx logs indicate, or lack thereof, that no communication reaches it.

The impression that I am left with is that openvpn prevents all WAN ips from getting to any given port. Is there a way to prevent this behavior? at least on port 80?

Routing table prior to openvpn running:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

Routing table while openvpn running:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.57     0.0.0.0         UG    0      0        0 tun0
10.10.10.1      10.10.10.57     255.255.255.255 UGH   0      0        0 tun0
10.10.10.57     0.0.0.0         255.255.255.255 UH    0      0        0 tun0
63.142.161.7    192.168.0.1     255.255.255.255 UGH   0      0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

Update2: After adding route-nopull to the openvpn client config file, I was able to serve web pages however the vpn has become useless. Almost there, but I do not know enough about routes to fix this issue.

share|improve this question
    
Your problem is routing, OpenVPN is irrelevant, other the that it happens to be the tool you used to change your routes. –  Zoredache Jul 26 '13 at 0:33
    
Provide your route table before and after openvpn is connected. –  Zoredache Jul 26 '13 at 0:34
    
@Zoredache - OK, on it –  Patrick Bateman Jul 26 '13 at 0:35
    
Routes have nothing to do with ports. Routes look at addresses. –  Zoredache Jul 26 '13 at 0:36
1  
@Zoredache - Thanks, you pushed me in the right direction. Placing the --route-nopull flag in the openvpn .conf file prevents the openvpn server from overwriting my routing tables. Using this flag fixed the issue for me. I'll put this into an answer once I am able to. Thanks again! –  Patrick Bateman Jul 26 '13 at 0:57

1 Answer 1

Your configuration of OpenVPN allow getting default gateway from remote system.

I pretend, that in the point of network, where is doing a NAT (on the ADSL modem or somwhere on the ISP server) you have mapping of public address to your internal server.

And there is a problem. Imagine this:

Someone from the internet with public IP address A.A.A.A want to see pages from your server, which like to be on the public address B.B.B.B. NAT point rewrite address B.B.B.B to real, but not public, address of your server, say 192.168.0.2, but source address is still the same - A.A.A.A. Your server serve this request, and will send answer - but answer will be send to address A.A.A.A from address 192.168.0.2 - through your default gateway!

If this scenario continues without OpenVPN, packet goes through default gateway of 192.168.0.1 and somewhere will be rewrited to have source address B.B.B.B instead of 192.168.0.2. Everythink goes well.

But if your scenario continues with OpenVPN, your server have to send packet to A.A.A.A via default gateway - but this is not 192.168.0.1, but 10.10.10.57. And in this case I cannot say, what will be with this packet done. Will it be rewritten to other source address, say C.C.C.C? Or will it be discarded?

Why you want have default gateway on the opposite site? You will need only route, which will fit addresses of opposite site, say 10.10.10.0/24 (maybe other, this is only example)...

In the configuration of OpenVPN server you have to remove line like:

push "redirect-gateway def1 bypass-dhcp"
share|improve this answer
    
I am not the admin of the OpenVPN server. In my scenario, my web server also has an openvpn client. My intention is that my machine should be able to serve web pages and local traffic while all other external traffic should funnel through the vpn. I have iptables setup for this, how can I setup the routes to handle this? –  Patrick Bateman Jul 30 '13 at 3:01
    
@PatrickBateman OpenVPN server is pushing to you only default gw route, which you don't want. Can you say to admin of Ovpn server to correct it and push to you only right subnet? –  Jan Marek Jul 30 '13 at 4:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.