How can I get my applications to use the tap0 device, rather than eth0?

Question

I am using Ubuntu and I'm trying to establish a vpn-connection to an Endian server, which seems to be based on openvpn.

I have installed openvpn and connected to the server, using the following command:

sudo openvpn --client --pull --comp-lzo --nobind --dev tap0 --ca /home/tkn/efw.pem --auth-user-pass --remote vpn.domain.tld 1194

The above was suggested in the FAQ for Endian-vpn.

It appears to be working, since I get the following output:

Mon Aug 24 20:58:00 2009 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar  9 2009
Enter Auth Username:tkn
Enter Auth Password:
Mon Aug 24 20:58:05 2009 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 24 20:58:05 2009 LZO compression initialized
Mon Aug 24 20:58:05 2009 UDPv4 link local: [undef]
Mon Aug 24 20:58:05 2009 UDPv4 link remote: 12.34.56.78:1194
Mon Aug 24 20:58:05 2009 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 24 20:58:05 2009 [127.0.0.1] Peer Connection Initiated with 12.34.56.78:1194
Mon Aug 24 20:58:06 2009 TUN/TAP device tap0 opened
Mon Aug 24 20:58:06 2009 /sbin/ifconfig tap0 192.168.10.153 netmask 255.255.255.0 mtu 1500 broadcast 192.168.10.255
Mon Aug 24 20:58:06 2009 Initialization Sequence Completed

However, if I open my browser and go to http://www.whatsmyip.org/, I get my own IP - not the remote network. Also, my network manager doesn't list the tap0 device. It's there if I select "edit connections", but I can't select it from the main dropdown.

What am I missing?

Answer 1

try putting line

redirect-gateway

in you OpenVPN config

Answer 2

What you want to do is nothing to do with the VPN. What you need to do is set up routing so you go through the VPN.

Moreover, if you want to masquerade your source IP address as the host's, you'll need to set up nat router on the other end as well.

So basically what you'll need to do is:

1. Set up the client's routing table so that the default route goes through the VPN - but be sure that you still have a route for the specific VPN host that goes through the public network (sending VPN traffic through the VPN would not be cool)
2. Set up the router at the other end to do source nat for your client's IP address, with appropriate rules.

The router should then NAT the source address on all the outbound packets your client routes through it, replacing its own public IP (masquerading). Then on the inbound packets, it should do the reverse and the packets should come back via the VPN.

Answer 3

You're missing either a default route, or a route that encompasses everything you want to use over the VPN.