Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Ubuntu and I'm trying to establish a vpn-connection to an Endian server, which seems to be based on openvpn.

I have installed openvpn and connected to the server, using the following command:

sudo openvpn --client --pull --comp-lzo --nobind --dev tap0 --ca /home/tkn/efw.pem --auth-user-pass --remote vpn.domain.tld 1194

The above was suggested in the FAQ for Endian-vpn.

It appears to be working, since I get the following output:

Mon Aug 24 20:58:00 2009 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar  9 2009
Enter Auth Username:tkn
Enter Auth Password:
Mon Aug 24 20:58:05 2009 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 24 20:58:05 2009 LZO compression initialized
Mon Aug 24 20:58:05 2009 UDPv4 link local: [undef]
Mon Aug 24 20:58:05 2009 UDPv4 link remote: 12.34.56.78:1194
Mon Aug 24 20:58:05 2009 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 24 20:58:05 2009 [127.0.0.1] Peer Connection Initiated with 12.34.56.78:1194
Mon Aug 24 20:58:06 2009 TUN/TAP device tap0 opened
Mon Aug 24 20:58:06 2009 /sbin/ifconfig tap0 192.168.10.153 netmask 255.255.255.0 mtu 1500 broadcast 192.168.10.255
Mon Aug 24 20:58:06 2009 Initialization Sequence Completed

However, if I open my browser and go to http://www.whatsmyip.org/, I get my own IP - not the remote network. Also, my network manager doesn't list the tap0 device. It's there if I select "edit connections", but I can't select it from the main dropdown.

What am I missing?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

try putting line

redirect-gateway

in you OpenVPN config

share|improve this answer
    
+1, this will add the routing needed to have all traffic going through the vpn. The issue is routes (as stated by others) but openvpn can handle the route tables for you. You need to make sure the vpn server and its external network are setup to allow the vpn traffic out to the Internet, the best way is to make the vpn server a NAT router for the VPN clients, iptables has a rule for it (its in the openvpn FAQ). –  Jimsmithkka Aug 25 '09 at 12:47
    
Thanks - This makes a difference. Unfortunately I can't access anything in my browser now, but from what I can deduce from the comments here, that is probably because the server end doesn't NAT for me? –  troelskn Aug 25 '09 at 16:20
    
OK. The problem appears to be that my dns-server isn't available from the remote net. I fixed this by changing to opendns' nameservers, since --redirect-gateway bypass-dns doesn't appear to work. I guess I could also add a route explicitly for those ips, but this is less manual work. Thanks again for pointing me in the right direction. –  troelskn Aug 25 '09 at 16:46
add comment

You're missing either a default route, or a route that encompasses everything you want to use over the VPN.

share|improve this answer
add comment

What you want to do is nothing to do with the VPN. What you need to do is set up routing so you go through the VPN.

Moreover, if you want to masquerade your source IP address as the host's, you'll need to set up nat router on the other end as well.

So basically what you'll need to do is:

  1. Set up the client's routing table so that the default route goes through the VPN - but be sure that you still have a route for the specific VPN host that goes through the public network (sending VPN traffic through the VPN would not be cool)
  2. Set up the router at the other end to do source nat for your client's IP address, with appropriate rules.

The router should then NAT the source address on all the outbound packets your client routes through it, replacing its own public IP (masquerading). Then on the inbound packets, it should do the reverse and the packets should come back via the VPN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.