Networking
It looks like you're assigning your clients to the same subnet as your main network. When you use tun
as your device, your server gives each client a /30 block.
I think some of your numbering choices were defined by the way you would set up an OpenVPN server with a tap
device (bridge) instead of a tun
. I've experienced better performance using tun
devices than tap
(bridge) devices in my experience for the home network, though I don't have any numbers to back up that feeling.
If you were to change your server
directive to server 192.168.3.0 255.255.255.0
, then your server would have an IP of 192.168.3.1/24 in addition to its normal 192.168.2._ address. I'm not sure on why it insists on the .1. It hasn't done me any harm, so I haven't pursued changing it. When your client machine connects, it would then be given an address like 192.168.3.6.
You don't need to specify the gateway for the route you're pushing. Saying push "route 192.168.1.0 255.255.255.0
should do it. If you're always going to be re-directing a clients traffic through the server, this will be redundant.
Make sure that routing is enabled on your machine:
echo 1 > /proc/sys/net/ipv4/ip_forward
To make this change persistent after a restart, open /etc/sysctl.conf
for editing and set the value of net.ipv4.ip_forward
to 1.
When client machines attempt to speak to the internet and beyond, they will need to go through the FORWARD chain in iptables
. You can use this to tweak exactly how much access you want VPN clients to have to your network or the internet.
DNS
As far as DNS goes, I would only push the one DNS server to remote clients once you've made sure that they can connect. This should be read by Windows clients right off the bat, but for Linux it needs an adjustment to the configuration file plus a few supporting scripts.
Grabbing my response to another similar topic on OpenVPN and DNS on Linux (NetworkManager is not changing /etc/resolv.conf after openvpn dns push):
For connecting to my home network (using Fedora 18 at the time), I used a script by gronke on GitHub (https://github.com/gronke/OpenVPN-linux-push) to automate the updating process.
To use these scripts, I added the following to my OpenVPN client file:
up /home/gadgeteering/tools/vpn/up.sh
down /home/gadgeteering/tools/vpn/down.sh
Make sure that the client has permission to run these scripts using chmod
.
up.sh:
#! /bin/bash
DEV=$1
if [ ! -d /tmp/openvpn ]; then
mkdir /tmp/openvpn
fi
CACHE_NAMESERVER="/tmp/openvpn/$DEV.nameserver"
echo -n "" > $CACHE_NAMESERVER
dns=dns
for opt in ${!foreign_option_*}
do
eval "dns=\${$opt#dhcp-option DNS }"
if [[ $dns =~ [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} ]]; then
if [ ! -f /etc/resolv.conf.default ]; then
cp /etc/resolv.conf /etc/resolv.conf.default
fi
cat /etc/resolv.conf | grep -v ^# | grep -v ^nameserver > /tmp/resolv.conf
echo "nameserver $dns" >> /tmp/resolv.conf
echo $dns >> $CACHE_NAMESERVER
cat /etc/resolv.conf | grep -v ^# | grep -v "nameserver $dns" | grep nameserver >> /tmp/resolv.conf
mv /tmp/resolv.conf /etc/resolv.conf
fi
done
down.sh:
#! /bin/bash
DEV=$1
CACHE_NAMESERVER="/tmp/openvpn/$DEV.nameserver"
echo $CACHE_NAMESERVER
if [ -f $CACHE_NAMESERVER ]; then
for ns in `cat $CACHE_NAMESERVER`; do
echo "Removing $ns from /etc/resolv.conf"
cat /etc/resolv.conf | grep -v "nameserver $ns" > /tmp/resolv.conf
mv /tmp/resolv.conf /etc/resolv.conf
done
fi